WO2020142884A1 - 切换传输路径的方法及装置 - Google Patents

切换传输路径的方法及装置 Download PDF

Info

Publication number
WO2020142884A1
WO2020142884A1 PCT/CN2019/070714 CN2019070714W WO2020142884A1 WO 2020142884 A1 WO2020142884 A1 WO 2020142884A1 CN 2019070714 W CN2019070714 W CN 2019070714W WO 2020142884 A1 WO2020142884 A1 WO 2020142884A1
Authority
WO
WIPO (PCT)
Prior art keywords
transmission path
session
message
terminal
security
Prior art date
Application number
PCT/CN2019/070714
Other languages
English (en)
French (fr)
Inventor
吴�荣
李�赫
尼米·瓦特里
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2019/070714 priority Critical patent/WO2020142884A1/zh
Priority to CN201980065195.9A priority patent/CN112789896B/zh
Publication of WO2020142884A1 publication Critical patent/WO2020142884A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/14—Reselecting a network or an air interface

Definitions

  • the present application relates to the field of communication technology, and in particular, to a method and device for switching transmission paths.
  • the security issue of mobile communication is getting more and more attention.
  • the sending end can perform encryption protection and integrity protection on the transmitted data
  • the receiving end can perform decryption and integrity verification on the received encrypted data, thereby realizing data security protection.
  • data security protection can be performed between the terminal and the base station.
  • the terminal in the case of upstream transmission, the terminal can send the data to the base station after completing encryption and integrity protection of the data.
  • the base station can be responsible for data decryption and integrity verification.
  • Data security can also be performed between the terminal and the user plane function (UPF).
  • UPF user plane function
  • the terminal in the case of upstream transmission, the terminal can send data to the UPF through the base station after the encryption and integrity protection of the data is completed.
  • UPF Can be responsible for data decryption and integrity verification.
  • Embodiments of the present application provide a method and device for switching transmission paths, which are used to make data security protection flexibly adapt to changing network scenarios.
  • a method for switching transmission paths including: a terminal receiving a second message for instructing to switch a secure transmission path of a terminal from an access network node, and according to the second message, a security context of at least one session of the terminal Switch from the source security context to the target security context, and transmit data belonging to at least one session on the target security transmission path according to the target security context of at least one session.
  • the secure transmission path of the terminal includes a first secure transmission path and a second secure transmission path.
  • the first secure transmission path is a user plane transmission path where the security termination point is the access network node and the terminal, and the second secure transmission path is the security termination.
  • Point is the user plane transmission path of the user plane gateway and the terminal, and the security endpoint is the node that securely protects the user plane data of the terminal;
  • the source security context of a session is when the data belonging to the session is transmitted on the source secure transmission path The security context used.
  • the target security context of a session is the security context used by the terminal when the data belonging to the session is transmitted on the target secure transmission path;
  • the source secure transmission path is the secure transmission path of the terminal before switching the secure transmission path of the terminal ;
  • the target safe transmission path is the safe transmission path of the terminal after switching the safe transmission path of the terminal.
  • the method provided in the first aspect can realize the switching between the first and second safety transmission paths of the terminal, so as to select whether to switch the safety transmission path of the terminal in different scenarios, so that the data security protection is flexible Adapt to changing network scenarios.
  • the second message includes first indication information; the first indication information is used to indicate the source safe transmission path and/or the target safe transmission path, or the first indication information is used to indicate the source safety termination Point and/or target security endpoint; where the source security endpoint is the security endpoint of the source secure transmission path; the target security endpoint is the security endpoint of the target secure transmission path, one of the source security endpoint and the target security endpoint It is an access network node and the other is a user plane gateway.
  • the method further includes: when the first indication information is used to indicate the source safe transmission path, the terminal determines the source safe transmission path according to the first indication information in the second message Or, in the case where the first indication information is used to indicate the target safe transmission path, the terminal determines the target safe transmission path according to the first indication information in the second message; or, the first indication information is used to indicate the source safe transmission path In the case of the target safe transmission path, the terminal determines the source safe transmission path and the target safe transmission path according to the first indication information in the second message; or, in the case where the first indication information is used to indicate the source safe termination point, the terminal Determine the source security endpoint according to the first indication information in the second message; or, in the case where the first indication information is used to indicate the target security endpoint, the terminal determines the target security endpoint according to the first indication information in the second message Or, in the case where the first indication information is used to indicate the source security endpoint and the target security endpoint, the terminal determines the source security endpoint and the target security endpoint according to the first indication
  • the second message further includes an identifier of the first session.
  • the second message is specifically used to indicate a safe transmission path of the first session of the switching terminal, and at least one session is the first session.
  • This possible implementation can switch the secure transmission path for a certain session, so that in different scenarios, you can choose whether to switch the secure transmission path of a certain session of the terminal, so that the security protection of data can be flexibly adapted to changing network scenarios .
  • the second message further includes an identifier of the first service flow of the first session.
  • the second message is specifically used to indicate a safe transmission path of the first service flow of the first session of the switching terminal
  • the terminal switches the security context of at least one session of the terminal from the source security context to the target security context according to the second message, including: the terminal switches the security context of the first service flow of the first session from the source security context to the second message Target security context;
  • the source security context of a business flow is the security context used by the terminal when the data belonging to the business flow is transmitted on the source secure transmission path, and the target security context of a business flow is the security of the data belonging to the business flow at the target
  • the terminal transmitting data belonging to at least one session on the target secure transmission path according to the target security context of at least one session, including: the terminal according to the target security of the first service flow of the first session
  • the context transmits the data of the first service flow belonging to the first session on the
  • a method for switching transmission paths which includes: a first network element determines a safe transmission path for switching terminals, and sends a first message indicating a safe transmission path for switching terminals to a second network element;
  • One network element is a mobility management network element, and the second network element is an access network node; or, the first network element is a session management network element, and the second network element is a user plane gateway.
  • the secure transmission path of the terminal includes a first secure transmission path and a second secure transmission path.
  • the first secure transmission path is a user plane transmission path where the security termination point is the access network node and the terminal, and the second secure transmission path is the security termination.
  • the point is the user plane gateway and the user plane transmission path of the terminal, and the security endpoint is a node that securely protects the user plane data of the terminal.
  • the method provided in the second aspect can realize the switching between the first and second safety transmission paths of the terminal, so as to select whether to switch the safety transmission path of the terminal in different scenarios, so that the data security protection is flexible Adapt to changing network scenarios.
  • the first message includes first indication information; the first indication information is used to indicate the source safe transmission path and/or the target safe transmission path, or the first indication information is used to indicate the source safety endpoint And/or target security endpoint; where the source security transmission path is the terminal’s secure transmission path before switching the terminal’s security transmission path; the target security transmission path is the terminal’s secure transmission path after switching the terminal's security transmission path; the source security endpoint It is the security endpoint of the source secure transmission path; the target security endpoint is the security endpoint of the target secure transmission path.
  • One of the source security endpoint and the target security endpoint is the access network node, and the other is the user plane gateway.
  • This possible implementation manner may enable the second network element to determine the source safe transmission path and/or the target safe transmission path; or, determine the source safe end point and/or the target safe end point.
  • the first message further includes an identifier of the first session, and the first message is specifically used to indicate a safe transmission path of the first session of the switching terminal.
  • This possible implementation can switch the secure transmission path for a certain session, so that in different scenarios, you can choose whether to switch the secure transmission path of a certain session of the terminal, so that the security of data can be flexibly adapted to changing network scenarios .
  • the first message further includes an identifier of the first service flow of the first session, and the first message is specifically used to instruct to switch the secure transmission path of the first service flow.
  • This possible implementation can switch the secure transmission path for a certain service flow, so that in different scenarios, you can choose whether to switch the secure transmission path of a certain service flow of the terminal, so that the data security protection can be flexibly adapted to the constantly changing Network scene.
  • the second network element is an access network node
  • the first indication information is at least used to indicate a target security endpoint
  • the target security endpoint is a user plane gateway
  • the first message further includes the user plane gateway's Upstream TEID.
  • the first network element determines the safe transmission path of the switching terminal, including: the first network element according to network load, network operation and deployment, local strategy, third-party strategy, operator strategy, big data
  • One or more of the analysis results determine the safe transmission path of the switching terminal; or, the first network element receives the second indication information and determines the safe transmission path of the switching terminal according to the second indication information, and the second indication information is used to instruct the switching terminal Safe transmission path.
  • a method for switching transmission paths including: a second network element receives a first message from a first network element for instructing to switch a safety transmission path of a terminal, and the safety termination point of the target safety transmission path includes In the case of the second network element, the second network element obtains the security context of at least one session of the terminal according to the first message, and uses the security context of the at least one session to perform security protection on the at least one session.
  • the secure transmission path of the terminal includes a first secure transmission path and a second secure transmission path.
  • the first secure transmission path is a user plane transmission path where the security termination point is the access network node and the terminal, and the second secure transmission path is the security termination.
  • Point is the user plane gateway and the user plane transmission path of the terminal, and the security endpoint is the node that securely protects the user plane data of the terminal;
  • the first network element is a mobility management network element and the second network element is an access network Node; or, the first network element is a session management network element, and the second network element is a user plane gateway; at least one session is a session switching from a source secure transmission path to a target secure transmission path, and the source secure transmission path is the security of the switching terminal
  • the safe transmission path of the terminal before the transmission path; the target safe transmission path is the safe transmission path of the terminal after switching the safe transmission path of the terminal.
  • the method provided in the third aspect can realize the switching between the first and second secure transmission paths of the terminal, so as to select whether to switch the secure transmission path of the terminal in different scenarios, so that the security protection of data is flexible Adapt to changing network scenarios.
  • the method further includes: in a case where the security endpoint of the target secure transmission path does not include the second network element, the second network element deletes the security context of at least one session according to the first message.
  • This possible implementation manner can save storage resources of the second network element.
  • the first message includes first indication information; the first indication information is used to indicate the source safe transmission path and/or the target safe transmission path, or the first indication information is used to indicate the source safety endpoint And/or target security endpoint; where the source security endpoint is the security endpoint of the source secure transmission path; the target security endpoint is the security endpoint of the target secure transmission path, and one of the source security endpoint and the target security endpoint is The access network node and the other is a user plane gateway.
  • the method further includes: in the case where the first indication information is used to indicate the source safe transmission path, the second network element determines the source security according to the first indication information in the first message Transmission path; or, in the case where the first indication information is used to indicate the target safe transmission path, the second network element determines the target safe transmission path according to the first indication information in the first message; or, the first indication information is used In the case of indicating the source safe transmission path and the target safe transmission path, the second network element determines the source safe transmission path and the target safe transmission path according to the first indication information in the first message; or, the first indication information is used to indicate the source In the case of a security endpoint, the second network element determines the source security endpoint according to the first indication information in the first message; or, in the case where the first indication information is used to indicate the target security endpoint, the second network element The first indication information in the first message determines the target security endpoint; or, in the case where the first indication information is used to indicate the source security endpoint and the target security endpoint, the second network
  • the first message further includes an identifier of the first session.
  • the first message is specifically used to indicate a secure transmission path of the first session of the switching terminal, and at least one session is the first session.
  • This possible implementation can switch the secure transmission path for a certain session, so that in different scenarios, you can choose whether to switch the secure transmission path of a certain session of the terminal, so that the security of data can be flexibly adapted to changing network scenarios .
  • the first message further includes an identifier of the first service flow of the first session, and the first message is specifically used to indicate a safe transmission path of the first service flow of the first session of the switching terminal;
  • the second The network element acquiring the security context of at least one session of the terminal according to the first message includes: the second network element acquiring the security context of the first service flow of the first session according to the first message.
  • the first message further includes an identifier of the first service flow of the first session.
  • the first message is specifically used to indicate a safe transmission path of the first service flow of the first session of the switching terminal.
  • the second network element deletes the security context of at least one session according to the first message, including: the second network element deletes the first of the first session according to the first message The security context of the business flow.
  • the second network element is an access network node
  • the first indication information is at least used to indicate a target security endpoint
  • the target security endpoint is a user plane gateway
  • the first message further includes the user plane gateway's
  • the method further includes: the second network element sends data belonging to at least one session to the user plane gateway through the tunnel indicated by the upstream TEID, and at least one session uses the security context of the at least one session for security protection.
  • the second network element is an access network node, and the method further includes: the second network element sends a second message to the terminal according to the first message, and the second message is used to instruct safe transmission of the switching terminal path.
  • This possible implementation manner may instruct the terminal to switch the secure transmission path, so that the terminal switches the security context, and ensure the correct transmission of data.
  • the second message when the first message includes the first indication information, the second message includes the first indication information.
  • This possible implementation manner may enable the terminal to determine the source safe transmission path and/or the target safe transmission path; or, determine the source safe end point and/or the target safe end point.
  • the second message further includes the identifier of the first session
  • the second message is specifically used to indicate the security of the first session of the switching terminal Transmission path.
  • the secure transmission path can be switched for a certain session, so that in different scenarios, the terminal can switch the security context of the session to ensure the correct transmission of data.
  • the second message when the first message further includes the identifier of the first service flow of the first session, the second message also includes the identifier of the first service flow of the first session, and the second message specifically uses To instruct to switch the secure transmission path of the first service flow.
  • the secure transmission path can be switched for a certain service flow, so that in different scenarios, the terminal can switch the security context of the service flow to ensure the correct transmission of data.
  • an apparatus for switching transmission paths including: a communication unit and a processing unit; the communication unit is configured to receive a second message from an access network node, and the second message is used to instruct to switch the A safe transmission path of a device that switches transmission paths.
  • the safe transmission path of the device that switches transmission paths includes a first safe transmission path and a second safe transmission path, where the first safe transmission path is a safety termination point that is an access network node And the user plane transmission path of the device for switching transmission paths, the second secure transmission path is a user plane transmission path for which the security endpoint is a user plane gateway and the device for switching transmission paths, and the security endpoint is a pair A node for performing security protection on user plane data of the device for switching transmission paths; the processing unit is configured to switch the security context of at least one session of the device for switching transmission paths from the source security context according to the second message
  • the source security context of a session is the security context used by the device that switches the transmission path when the data belonging to the session is transmitted on the source secure transmission path, and the target security context of a session is the data belonging to the session
  • the source safe transmission path is the security of the device for switching transmission paths before the secure transmission path of the device for
  • the second message includes first indication information; the first indication information is used to indicate a source safe transmission path and/or a target safe transmission path, or the first indication information Used to indicate a source security endpoint and/or a target security endpoint; wherein the source security endpoint is a security endpoint of the source security transmission path; the target security endpoint is the security of the target security transmission path An end point, one of the source security end point and the target security end point is the access network node, and the other is the user plane gateway; the first indication information is used to indicate the source safe transmission In the case of a path, the processing unit is further configured to determine the source safe transmission path according to the first indication information in the second message; or, the first indication information is used to indicate the target safe transmission In the case of a path, the processing unit is further configured to determine the target safe transmission path according to the first indication information in the second message; or, the first indication information is used to indicate the source safe transmission In the case of the path and the target safe transmission path, the processing unit is further configured to determine
  • the second message further includes an identifier of the first session, and the second message is specifically used to instruct a safe transmission path of the first session of the apparatus for switching the transmission path,
  • the at least one session is the first session.
  • the second message further includes an identifier of the first service flow of the first session, and the second message is specifically used to indicate the first message of the apparatus for switching the transmission path.
  • a secure transmission path of the first service flow of a session the processing unit is specifically configured to: switch the security context of the first service flow of the first session from the source security context according to the second message To the target security context;
  • the source security context of a business flow is the security context used by the device that switches the transmission path when the data belonging to the business flow is transmitted on the source security transmission path, and the target security context of a business flow belongs to the The security context used by the device for switching transmission paths when the data of the service flow is transmitted on the target secure transmission path;
  • the processing unit is specifically configured to: according to the target security of the first service flow of the first session The context transmits the data of the first service flow belonging to the first session on the target secure transmission path.
  • an apparatus for switching transmission paths including: a communication unit and a processing unit; the processing unit is configured to determine a safe transmission path for switching a terminal, and the safe transmission path of the terminal includes a first safe transmission path And a second secure transmission path, the first secure transmission path is a user plane transmission path where the security endpoint is the access network node and the terminal, and the second secure transmission path is the user plane gateway and all the security endpoints
  • the user plane transmission path of the terminal, the security endpoint is a node that securely protects the user plane data of the terminal
  • the communication unit is configured to send a first message to the second network element, the first message For instructing to switch the secure transmission path of the terminal; wherein, the device for switching the transmission path is a mobility management network element, and the second network element is the access network node; or, for the switching transmission path
  • the device is a session management network element, and the second network element is the user plane gateway.
  • the first message includes first indication information; the first indication information is used to indicate a source safe transmission path and/or a target safe transmission path, or the first indication information is used Indicate the source safety endpoint and/or target safety endpoint; wherein the source safety transmission path is the terminal's safety transmission path before switching the terminal's safety transmission path; the target safety transmission path is to switch the The secure transmission path of the terminal after the secure transmission path of the terminal; the source security termination point is the security termination point of the source secure transmission path; the target security termination point is the security termination point of the target secure transmission path, One of the source security endpoint and the target security endpoint is the access network node, and the other is the user plane gateway.
  • the first message further includes an identifier of the first session, and the first message is specifically used to instruct to switch the secure transmission path of the first session of the terminal.
  • the first message further includes an identifier of the first service flow of the first session, and the first message is specifically used to instruct to switch the secure transmission path of the first service flow.
  • the second network element is the access network node
  • the first indication information is at least used to indicate the target security endpoint
  • the target security endpoint is the user
  • the first message further includes the uplink TEID of the user plane gateway.
  • the processing unit is also used to determine the handover according to one or more of network load, network operation and deployment, local strategy, third-party strategy, operator strategy, and big data analysis results A secure transmission path of the terminal; or, the communication unit is further configured to receive second indication information and determine to switch the secure transmission path of the terminal according to the second indication information, and the second indication information is used to indicate Switching the secure transmission path of the terminal.
  • an apparatus for switching a transmission path including: a communication unit and a processing unit; the communication unit is configured to receive a first message from a first network element, and the first message is used to indicate a switching terminal
  • a safe transmission path the safe transmission path of the terminal includes a first safe transmission path and a second safe transmission path
  • the first safe transmission path is a user plane transmission path where the safe termination point is an access network node and the terminal
  • the second secure transmission path is a user plane gateway where the security endpoint is the user plane gateway and the terminal, and the security endpoint is a node that securely protects the user plane data of the terminal;
  • the first One network element is a mobility management network element, the device for switching transmission paths is the access network node; or, the first network element is a session management network element, and the device for switching transmission paths is the user Face gateway; in the case where the security end point of the target secure transmission path includes the device for switching transmission paths, the processing unit is configured to obtain the security context of at least one session of
  • the processing unit is further configured to delete the device according to the first message The security context of at least one session.
  • the first message includes first indication information; the first indication information is used to indicate a source safe transmission path and/or a target safe transmission path, or the first indication information is used Indicate the source security endpoint and/or target security endpoint; wherein, the source security endpoint is the security endpoint of the source secure transmission path; the target security endpoint is the security endpoint of the target secure transmission path Point, one of the source security endpoint and the target security endpoint is the access network node, and the other is the user plane gateway; the first indication information is used to indicate the source secure transmission path
  • the processing unit is further configured to determine the source safe transmission path according to the first indication information in the first message; or, the first indication information is used to indicate the target safe transmission path
  • the processing unit is further configured to determine the target safe transmission path according to the first indication information in the first message; or, the first indication information is used to indicate the source safe transmission path
  • the processing unit is further configured to determine the source secure transmission path and the target secure transmission path
  • the first message further includes an identifier of the first session, the first message is specifically used to instruct to switch the secure transmission path of the first session of the terminal, the at least one The session is the first session.
  • the first message further includes an identifier of the first service flow of the first session, and the first message is specifically used to indicate a location for switching the first session of the terminal
  • the secure transmission path of the first service flow; the processing unit is specifically configured to: obtain the security context of the first service flow of the first session according to the first message.
  • the first message further includes an identifier of the first service flow of the first session, and the first message is specifically used to indicate a location for switching the first session of the terminal The safe transmission path of the first service flow, in the case where the safety termination point of the target safe transmission path does not include the device for switching the transmission path; the processing unit is specifically configured to: delete according to the first message The security context of the first service flow of the first session.
  • the device for switching transmission paths is the access network node
  • the first indication information is at least used to indicate the target security endpoint
  • the target security endpoint is the The user plane gateway
  • the first message further includes an uplink TEID of the user plane gateway
  • the processing unit is further configured to send the user plane gateway to the user plane gateway by using the communication unit through the tunnel indicated by the uplink TEID.
  • the data of the at least one session, the at least one session uses the security context of the at least one session for security protection.
  • the device for switching transmission paths is the access network node; the processing unit is further configured to send a second to the terminal through the communication unit according to the first message Message, the second message is used to instruct to switch the secure transmission path of the terminal.
  • the second message when the first message includes the first indication information, the second message includes the first indication information.
  • the second message when the first message further includes the identifier of the first session, the second message further includes the identifier of the first session, and the second message is specifically used To instruct to switch the secure transmission path of the first session of the terminal.
  • the second message further includes the first service flow of the first session , the second message is specifically used to instruct to switch the secure transmission path of the first service flow.
  • a device for switching transmission paths includes: a memory and a processor; optionally, at least one communication interface and a communication bus; and the memory is used to store computer execution instructions and processing.
  • the memory, the memory, and the at least one communication interface are connected by a communication bus, and the processor executes the computer-executed instructions stored in the memory, so that the device for switching the transmission path implements any method provided in any one of the first aspect to the third aspect.
  • the device can exist in the form of a chip product.
  • a communication system including: the apparatus for switching transmission paths provided in the fourth, fifth, and sixth aspects.
  • a computer-readable storage medium which includes instructions that when executed on a computer, cause the computer to perform any method provided in any one of the first to third aspects.
  • a computer program product containing instructions that, when run on a computer, cause the computer to perform any method provided in any one of the first aspect to the third aspect.
  • Figure 1 is a schematic diagram of the composition of a network architecture
  • FIG. 2 is a schematic diagram of a secure transmission path provided by an embodiment of this application.
  • FIG. 3 is a flowchart of a method for switching transmission paths according to an embodiment of the present application.
  • FIG. 6 is a flowchart of another method for switching transmission paths according to an embodiment of the present application.
  • FIG. 7 is a flowchart of another method for switching transmission paths according to an embodiment of the present application.
  • FIG. 8 is a schematic diagram of the composition of an apparatus for switching transmission paths according to an embodiment of the present application.
  • FIG. 9 is a schematic diagram of a hardware structure of an apparatus for switching transmission paths according to an embodiment of the present application.
  • FIG. 10 is a schematic diagram of a hardware structure of a terminal and an access network node provided by an embodiment of the present application.
  • words such as “first” and “second” are used to distinguish the same or similar items whose functions and functions are basically the same. Those skilled in the art may understand that the words “first” and “second” do not limit the number and the execution order, and the words “first” and “second” are not necessarily different.
  • orthogonal frequency division multiple access orthogonal frequency-division multiple access
  • SC-FDMA single carrier frequency division multiple access
  • system can be used interchangeably with "network”.
  • the OFDMA system can realize wireless technologies such as evolved universal wireless terrestrial access (evolved universal terrestrial radio access, E-UTRA for short), ultra mobile broadband (ultra mobile broadband, UMB for short) and so on.
  • E-UTRA is an evolved version of the Universal Mobile Telecommunications System (UMTS).
  • the 3rd Generation Partnership Project (3GPP) is a new version using E-UTRA in long term evolution (LTE) and various versions based on LTE evolution.
  • the 5th-generation (5G) communication system and the new radio (NR) communication system are the next-generation communication systems under study.
  • the communication system can also be adapted to future-oriented communication technologies, and all the technical solutions provided by the embodiments of the present application are applicable.
  • the method provided by the embodiment of the present application may be applied to the 5G communication system shown in FIG. 1.
  • the 5G communication system may include one or more of the following network functions (NF) entities: authentication server function (AUSF) entities, access and mobility management Function (access and mobility management function, AMF) entity, session management function (SMF) entity, (radio) access network ((radio) access network (R)AN) device, UPF entity, Data network (DN), terminal, application function (AF) entity, unified data management (UDM) entity, policy control function (PCF) entity, network Open function (network exposure function, NEF) entity, network function repository function (NRF) entity.
  • NF network functions
  • RAN equipment refers to equipment in the RAN.
  • An access network that implements an access network function based on wireless communication technology may be referred to as a RAN.
  • RAN can manage wireless resources, provide access services for terminals, and then complete the transfer of control signals and user data between the terminal and the core network.
  • the RAN may use 3GPP access technologies (for example, wireless access technologies used in 3G, 4G, or 5G communication systems) and non-3GPP (non-3GPP) access technologies.
  • RAN provides network access for authorized users in a specific area, and can use different quality transmission tunnels according to the user's level and service requirements.
  • the non-3GPP access technology refers to an access technology that does not conform to the 3GPP standard specifications, for example, an air interface technology represented by an access point (AP) in wireless fidelity (WIFI).
  • AP access point
  • WIFI wireless fidelity
  • the RAN equipment is mainly responsible for radio resource management, quality of service (QoS) management, data compression, and encryption functions on the air interface side.
  • the RAN device may include various forms of base stations, such as: macro base stations, micro base stations (also called small stations), relay stations, APs, and so on.
  • a base station is called a next-generation base station (next generation node) (gNB for short).
  • the RAN device in the 5G communication system may also be called an NG-RAN device or an NG-RAN node.
  • the AMF entity belongs to the core network entity, and is mainly responsible for the mobility management processing part, such as access control, mobility management, attachment and detachment, and SMF entity selection.
  • the AMF entity When the AMF entity provides services for the session in the terminal, it will provide control plane storage resources for the session to store the session ID, the SMF entity ID associated with the session ID, and so on.
  • the SMF entity is mainly used for session management, terminal Internet protocol (IP) address allocation and management, selection of endpoints that can manage user plane functions, policy control, or charging function interfaces, and downstream data notification.
  • IP Internet protocol
  • the UPF entity can be used for packet routing and forwarding, or QoS processing of user plane data.
  • User data can be accessed to the DN through this network element.
  • DN is a network used to provide transmission data.
  • the operator's business network the Internet (Internet) network, third-party business network, etc.
  • the network elements involved in the embodiments of the present application include mobility management network elements, session management network elements, user plane gateways, access network nodes and terminals.
  • the access network node may be various forms of macro base stations, micro base stations (also called small stations), relay stations, APs, etc., and may also include various forms of control nodes, such as network controllers.
  • the control node may connect multiple base stations and configure resources for multiple terminals covered by the multiple base stations.
  • the names of devices with base station functions may be different, for example, global system for mobile (GSM) or code division multiple access (code division multiple access) Access (referred to as CDMA) network can be referred to as base transceiver station (BTS), wideband code division multiple access (wideband code division multiple access (WCDMA) can be referred to as base station (NodeB), LTE system It may be called evolved NodeB (evolved NodeB, eNB or eNodeB for short), and may be called gNB in 5G communication system or NR communication system.
  • GSM global system for mobile
  • CDMA code division multiple access
  • BTS base transceiver station
  • WCDMA wideband code division multiple access
  • NodeB LTE system
  • eNB evolved NodeB
  • gNB evolved NodeB
  • 5G communication system or NR communication system.
  • NR NR communication system
  • the specific name of the base station is not limited in this application.
  • the access network node may also be a wireless controller in a cloud radio access network (cloud radio access network, CRAN for short) scenario, and an access network in a public land mobile network (PLMN) network that will evolve in the future Nodes, transmission and reception nodes (transmission and reception points, TRP for short), etc.
  • cloud radio access network cloud radio access network
  • PLMN public land mobile network
  • a terminal may also be called a user equipment (user equipment, UE for short), terminal equipment, access terminal, subscriber unit, user station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless communication device, user agent or User devices, etc.
  • Terminals can be drones, internet of things (IoT) devices (for example, sensors, electricity meters, water meters, etc.), vehicle-to-everything (V2X) devices, and wireless local area networks (wireless local areas) networks , Referred to as WLAN) stations (ST, ST), cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital processing (personal digital assistant, PDA for short) devices, handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices (also called wearable smart devices).
  • the terminal may also be a terminal in a next-generation communication system, for example, a terminal in a 5G communication system or a terminal in a PLM
  • the user plane gateway may be a user plane gateway in each communication system, for example, a UPF entity, or a gateway proxy (proxy), for example, a UPF proxy, and NEF that may have a user plane gateway function.
  • the user plane gateway functions include packet routing and forwarding of user plane data, and QoS processing of user plane data.
  • the mobility management network element is hereinafter referred to as AMF (that is, AMF can be replaced with mobility management network element in the following), and the session management network element is denoted as SMF (that is, SMF can be replaced with session management hereinafter) Network element),
  • the access network node is hereinafter referred to as the RAN node (that is, the RAN nodes in the following can be replaced with access network nodes), and the user plane gateway is hereinafter referred to as the UPF (that is, the UPF in the following can be replaced by users) Face gateway).
  • the network elements involved in the embodiments of the present application are all network elements in the NR communication system or the 5G communication system. It can be understood that when the method provided by the embodiments of the present application is applied to other communication systems (for example, 4G communication systems, future In the communication system), the network element in the 5G communication system can be replaced with a network element in the other communication system having the same or similar function. For example, when the method provided by the embodiment of the present application is applied to a 4G communication system, the AMF in the following may be replaced with MME.
  • Small data refers to data with a small amount of data.
  • data transmitted between DN and Internet of Things devices such as distance meters, water meters, electricity meters, sensors, etc.
  • Small data transmission is mainly used in cellular Internet of Things (CIoT), and can be used for terminals with low complexity, energy limitation and low transmission rate.
  • these terminals may be low mobility, for example, water meters, electricity meters, etc.
  • the security context refers to information that can be used to implement data security protection (eg, encryption and decryption and/or integrity protection).
  • data security protection eg, encryption and decryption and/or integrity protection
  • the security context may include: encryption key/decryption key, integrity protection key, fresh parameters (such as NAS Count, where NAS refers to non-access stratum), key set identifier (key set identifier (abbreviated as KSI), security algorithm, security-related instructions (for example, whether to enable encryption, whether to enable integrity protection, key usage period, key length), etc.
  • the encryption key is a parameter input when the sender encrypts the plain text according to the encryption algorithm to generate the cipher text. If symmetric encryption is used, the encryption key and decryption key are the same.
  • the receiving end can decrypt the ciphertext according to the same encryption algorithm and encryption key. In other words, the sending end and the receiving end can encrypt and decrypt based on the same key.
  • the integrity protection key is a parameter input when the sender performs integrity protection on the plain text or cipher text according to the integrity protection algorithm.
  • the receiving end can perform integrity verification on the integrity-protected data according to the same integrity protection algorithm and integrity protection key.
  • the security algorithm is the algorithm used to protect the data. For example, encryption algorithm, decryption algorithm, integrity protection algorithm, etc.
  • the security endpoint is a node that securely protects the user plane data of the terminal.
  • the security endpoint is responsible for data encryption and decryption and/or integrity protection.
  • the session in the embodiment of the present application refers to a data connection between the terminal and the service network.
  • a session can be called a protocol data unit (protocol data unit, PDU for short) session in a 5G communication network, and can be called a bearer in a 4G communication network.
  • PDU protocol data unit
  • a session may include multiple service flows, and the service flow may be a Qos flow in a 5G communication network.
  • the secure transmission path refers to the transmission path between two security endpoints. Among them, one security endpoint is responsible for data encryption and integrity protection, and the other security endpoint is responsible for data decryption and integrity verification.
  • the two security endpoints may be a terminal and a RAN node.
  • user plane security is established between the terminal and the RAN node.
  • the secure transmission path may be referred to as: UE-RAN secure transmission path.
  • the security context adopted by the security endpoint may be called: UE-RAN security context.
  • these two security endpoints may also be a terminal and a UPF.
  • user plane security is established between the terminal and the UPF.
  • the secure transmission path may be referred to as: UE-UPF secure transmission path.
  • the security context adopted by the security endpoint may be called: UE-UPF security context.
  • the UE-UPF secure transmission path may be a small data fast path (SDFP), which is used to optimize the small data of the CIOT terminal in the context management idle state (IDLE, CM-IDLE) state. transmission. Specifically, it is to establish a fast channel, so that small data can be quickly transmitted through the N3 and N6 interfaces on the terminal ⁇ RAN node ⁇ UPF dedicated channel. SDFP can be established during the state transition between CM-IDLE and context management connection (CM-CONNECTED). CM-CONNECTED refers to the state when the terminal is connected or the state of transmitting data. CM-IDLE and CM- No or little signaling interaction is required during the state transition of CONNECTED.
  • SDFP small data fast path
  • CM-CONNECTED refers to the state when the terminal is connected or the state of transmitting data.
  • CM-IDLE and CM- No or little signaling interaction is required during the state transition of CONNECTED.
  • the data transmission method of transmitting data through the UE-RAN secure transmission path and the data transmission method of transmitting data through the UE-UPF secure transmission path can be considered as two different types of secure transmission methods.
  • the following switching of secure transmission The path can also be considered as switching the secure transmission method.
  • Source secure transmission path target secure transmission path
  • source secure endpoint target secure endpoint
  • the embodiment of the present application relates to the scenario of switching the secure transmission path of the terminal. Therefore, the embodiments of the present application define the concepts of the source secure transmission path, the target secure transmission path, the source secure endpoint, and the target secure endpoint.
  • the source safe transmission path is the safe transmission path of the terminal before the safe transmission path of the terminal is switched.
  • the target safe transmission path is the safe transmission path of the terminal after switching the safe transmission path of the terminal.
  • the source security endpoint is the security endpoint of the source secure transmission path.
  • the target security endpoint is the security endpoint of the target secure transmission path.
  • one of the source security endpoint and the target security endpoint is a RAN node, and the other is a UPF.
  • the source security endpoint is a RAN node and the target security endpoint is UPF; or, the source security endpoint is UPF and the target security endpoint is a RAN node.
  • the terminal in the embodiment of the present application supports data transmission through different secure transmission paths.
  • the terminal uses one of the secure transmission paths to transmit data, if the other secure transmission path is better, or the security endpoint needs to be switched, the terminal needs to switch
  • the security transmission path of the terminal accordingly needs to switch the security context of the terminal so that each network element uses the correct security context to transmit data.
  • the embodiments of the present application provide a method for switching transmission paths, which can be applied to scenarios where a secure transmission path needs to be switched.
  • An embodiment of the present application provides a method for switching transmission paths, including:
  • the first network element determines the safe transmission path of the switching terminal.
  • the first network element is AMF or SMF.
  • the secure transmission path of the terminal includes a first secure transmission path and a second secure transmission path.
  • the first safety transmission path is a user plane transmission path where the safety endpoint is a RAN node and a terminal, that is, a UE-RAN safety transmission path.
  • the second security transmission path is a user plane transmission path whose security end point is UPF and terminal, that is, a UE-UPF security transmission path.
  • the first network element sends a first message to the second network element, where the first message is used to instruct to switch the secure transmission path of the terminal.
  • the second network element receives the first message from the first network element.
  • the second network element when the first network element is AMF, the second network element is a RAN node.
  • the first network element is SMF, the second network element is UPF.
  • the first message is recorded as the first message A, and the first message A may be a next generation application protocol (NGAP) message, N2 message, or the like.
  • NGAP next generation application protocol
  • the first message is recorded as the first message B.
  • the first message B may be an N4 message, for example, an N4 session establishment request (N4 Session Establishment Request), an N4 session modification request (N4 Session Modification Request), etc. Since the first message A and the first message B are messages transmitted between different network elements, it can be seen that the first message A and the first message B are necessarily different messages.
  • the first message may also be referred to as a switching request, a safety endpoint switching request, a safety transmission path switching request, etc.
  • the first message may be understood as a message informing the safety transmission path switching, and the message name may be different according to specific business scenarios.
  • step 303 may be performed after step 302.
  • step 304 may be performed after step 302 (step 304 is an optional step).
  • the second network element obtains the security context of at least one session of the terminal according to the first message, and uses the security context of the at least one session to perform security protection on the at least one session.
  • At least one session is a session switched from the source secure transmission path to the target secure transmission path.
  • At least one session of the terminal may be the entire session of the terminal, or may be a partial session of the terminal.
  • the RAN node may search for the security context of at least one session from the stored security context, or may generate the security context of at least one session by itself.
  • the UPF can obtain the security context of at least one session from the SMF, or can generate the security context of at least one session by itself.
  • the second network element may reconfigure at least one session of the terminal. Further, after reconfiguring at least one session of the terminal, the second network element may immediately activate the integrity protection and/or encryption of at least one session, or may activate the integrity protection and at least one session during data transmission. /Or encryption.
  • the second network element deletes the security context of at least one session according to the first message.
  • step 304 may have the effect of saving the storage space of the second network element.
  • the second network element may not delete the security context of at least one session, so as to resume at least one session later.
  • the method provided in the embodiment of the present application can realize the switching between the first and second secure transmission paths of the terminal, so as to select whether to switch the secure transmission path of the terminal in different scenarios, so that the security protection of the data is flexible Adapt to changing network scenarios.
  • step 301 may be implemented in any one of the following manner 1 or manner 2 during specific implementation.
  • the first network element determines the safe transmission path of the switching terminal according to one or more of network load, network operation and deployment, local strategy, third-party strategy, operator strategy, and big data analysis results.
  • the first network element may determine that when the load of the RAN node is high (for example, greater than or equal to 80%) The UE-RAN secure transmission path is switched to the UE-UPF secure transmission path. In another possible implementation manner, when the load of the RAN node returns to normal (for example, 60% or less), the first network element may determine to switch the UE-UPF secure transmission path to the UE-RAN secure transmission path.
  • a possible implementation manner is that if an UPF reselection (also called handover) event or other mobility event occurs, when When the UPF selected by the SMF does not support the UE-UPF secure transmission path, the first network element determines to switch the UE-UPF secure transmission path to the UE-RAN secure transmission path, where the security endpoint of the UE-UPF secure transmission path includes UPF Reselect the previous UPF.
  • UPF reselection also called handover
  • the first network element determines to switch the UE-RAN secure transmission path to the UE-UPF secure transmission path
  • the security end point of the UE-UPF secure transmission path includes the UPF after UPF reselection.
  • the first network element may also determine the safe transmission path of the switching terminal according to local strategies, third-party strategies, operator strategies, and so on.
  • the local strategy, third-party strategy, and operator strategy here can be local, third-party, and operator-configured rules for determining the secure transmission path of the switching terminal.
  • the rules can be determined according to actual application scenarios. The description will not be expanded one by one.
  • the local strategy may be a strategy configured by the regional operator or a third party on the first network element.
  • the first network element can also determine the safe transmission path of the switching terminal according to the big data analysis result.
  • the first network The element may determine to switch the UE-UPF secure transmission path to the UE-RAN secure transmission path.
  • the first network element may also determine the safe transmission path of the switching terminal according to multiple of network load, network operation and deployment, local strategy, third-party strategy, operator strategy, and big data analysis results. For example, the first network element determines the safe transmission path of the switching terminal according to network load and network operation and deployment. In this case, if a UPF reselection event occurs, when the UPF selected by the SMF supports the UE-UPF secure transmission path and the load of the RAN node is high (for example, greater than or equal to 80%), the first network element determines that the UE- The RAN secure transmission path is switched to the UE-UPF secure transmission path, where the security endpoint of the UE-UPF secure transmission path includes the UPF after UPF reselection.
  • the first network element receives the second indication information, and determines the safe transmission path of the switching terminal according to the second indication information, and the second indication information is used to instruct the safe transmission path of the switching terminal.
  • the network element that determines the safe transmission path of the switching terminal may be one or more of PCF, NEF, AF, or other network elements that can provide user data transmission strategy information.
  • PCF, NEF, AF, or other network elements that can provide user data transmission strategy information may determine the safe transmission path of the switching terminal in a manner similar to the method in which the first network element determines the safe transmission path of the switching terminal.
  • the first network element may receive second indication information from PCF, NEF, AF, or other network elements that can provide user data transmission strategy information.
  • the first network element may also receive the second indication information from the SMF.
  • the SMF may use method one to determine the secure transmission path of the switching terminal, or, according to PCF, NEF, AF, or other
  • the second indication information sent by the network element of the user data transmission strategy information determines the safe transmission path of the switching terminal.
  • the first network element may also receive the second indication information from the AMF.
  • the AMF may adopt the first method to determine the secure transmission path of the switching terminal, or, according to PCF, NEF, AF, or other
  • the second indication information sent by the network element of the user data transmission strategy information determines the safe transmission path of the switching terminal.
  • FIGS. 3 to 6 when the first network element is AMF, the above steps 301 to 304 are denoted as steps 301a to 304a. When the first network element is SMF, the above steps 301 to 304 are recorded as steps 301b to 304b.
  • the terminal’s secure transmission path is switched from the UE-UPF secure transmission path to the UE-RAN secure transmission path.
  • the terminal’s secure transmission path is transmitted from the UE-RAN secure transmission path. The path is switched to the UE-UPF secure transmission path.
  • the above method further includes: 300a.
  • the SMF sends the second indication information to the AMF.
  • step 301a specifically includes: the AMF determines the safe transmission path of the switching terminal according to the second indication information.
  • the above method further includes: 300b, AMF sends second indication information to the SMF.
  • step 301b specifically includes: the SMF determines the safe transmission path of the switching terminal according to the second indication information.
  • the first message includes first indication information; the first indication information is used to indicate the source safe transmission path and/or the target safe transmission path, or the first indication information is used to indicate the source safe termination point and/or the target safety Endpoint.
  • the above method further includes:
  • the second network element determines the source safe transmission path according to the first indication information in the first message; or,
  • the second network element determines the target safe transmission path according to the first indication information in the first message; or,
  • the second network element determines the source safe transmission path and the target safe transmission path according to the first indication information in the first message; or,
  • the second network element determines the source security endpoint according to the first indication information in the first message; or,
  • the second network element determines the target security endpoint according to the first indication information in the first message; or,
  • the second network element determines the source security endpoint and the target security endpoint according to the first indication information in the first message.
  • the first indication information may be indicated by one or more bits, and the value of the one or more bits represents It is determined whether the source safety transmission path or the target safety transmission path is a UE-UPF safety transmission path or a UE-RAN safety transmission path. For example, when the value of a bit is 0, it means that the source safety transmission path is the UE-UPF safety transmission path, then the target safety transmission path is naturally the UE-RAN safety transmission path; when the value of this bit is 1, it means the source safety The transmission path is a UE-RAN secure transmission path, then the target secure transmission path is naturally a UE-UPF secure transmission path.
  • the first indication information may also be indicated by a character string.
  • a character string For example, when the character string is "Normal”, it indicates that the source safety transmission path or the destination safety transmission path is the UE-RAN safety transmission path, and when the character string is "Small data” or " “SDFP” means that the source secure transmission path or the target secure transmission path is a UE-UPF secure transmission path.
  • the first indication information may be indicated by multiple bits. Among them, one bit is used to indicate the source safe transmission path, and the other bit is used to indicate the target safe transmission path.
  • the first indication information may be the identification of the source security endpoint and/or the identification of the target security endpoint.
  • One of the source and destination security endpoints is a RAN node, and the other is a UPF.
  • the identifier of the RAN node may be the identifier of the cell, the identifier of the base station, the identifier of the centralized unit (CU) of the base station, the identifier of the distributed unit (DU) of the base station, and the frequency of the base station , The control plane of the base station, and the user plane of the base station.
  • the identity of the UPF may be the index value of the UPF, the counter value of the UPF (indicating the number of UPFs), the IP address of the UPF, the tunnel ID corresponding to the UPF, etc.
  • the source security endpoint before the completion of the UPF reselection, may be the UPF before the completion of the UPF reselection.
  • the source security endpoint can also be a RAN node.
  • the target security endpoint before the completion of UPF reselection, can re-select the service for the terminal as SMF or UPF before reselection. That is, UPF reselection requires UPF to be reselected).
  • the target security endpoint may be the UPF after the UPF reselection is completed.
  • the first message further includes an identifier of the first session, and the first message is specifically used to instruct to switch the secure transmission path of the first session of the terminal.
  • the at least one session is the first session.
  • the first network element may further determine that the switched secure transmission path of the first session of the terminal.
  • the above-mentioned second instruction information is specifically used to instruct to switch the secure transmission path of the first session of the terminal.
  • the second indication information may also be used to indicate the source safe transmission path and the target safe transmission path.
  • the first session may include one or more sessions.
  • the identifier of the session may be a PDU session ID (PDU session ID), a service ID corresponding to the session, a service type of the service corresponding to the session, and so on.
  • One session may include one or more service flows, and in the second network element, one session may correspond to one security context.
  • the session taking the session as the PDU session and the service flow as the Qos flow as an example, refer to Table 1.
  • the second network element can obtain the security context 1 and use the security context 1 for the PDU session 1 Safety protection.
  • the second network element may obtain security context 2 and security context 3, and use security context 2 and security context 3 to perform security protection on PDU session 2 and PDU session 3, respectively.
  • the first message further includes an identifier of the first service flow of the first session, and the first message is specifically used to instruct to switch the secure transmission path of the first service flow.
  • step 303 when specifically implemented, may include: the second network element acquiring the security context of the first service flow of the first session according to the first message.
  • step 304 when specifically implemented in step 304, it may include: the second network element deleting the security context of the first service flow of the first session according to the first message.
  • the second network element may reconfigure the first service flow of the first session of the terminal. Further, after reconfiguring the first service flow of the first session of the terminal, the second network element may immediately activate the integrity protection and/or encryption of the first service flow of the first session, or may perform data transmission. Activate the integrity protection and/or encryption of the first service flow of the first session.
  • the first network element may further determine the switched secure transmission path of the first service flow of the first session of the terminal.
  • the above-mentioned second indication information is specifically used to instruct the switching of the secure transmission path of the first service flow of the first session of the terminal. Further, the second indication information may also be used to indicate the source safe transmission path and the target safe transmission path.
  • the first service flow may include one or more service flows.
  • the service flow identifier may include but is not limited to one or more of the following information: QoS flow identifier (QoS flow identifier (QFI), 5G Qos identifier (5G QoS identifier, 5QI), QoS identifier (Identifier).
  • all service flows of a session may correspond to a security context.
  • the session is the PDU session
  • the service flow is the Qos flow 1 of the PDU session 1
  • the first The two network elements can obtain the security context 1, and use the security context 1 to secure the Qos flow 1 of the PDU session 1.
  • the second network element can obtain security context 2 and security Context 3, and the security context 2 and the security context 3 are used to protect the Qos flow 2 of the PDU session 2 and the Qos flow 1 of the PDU session 3, respectively.
  • multiple service flows of a session may also correspond to a security context.
  • the session is PDU session 1
  • the service flow of the first session is Qos flow 1 of PDU session 1
  • the first The two network elements can obtain the security context 1, and use the security context 1 to secure the Qos flow 1 of the PDU session 1.
  • the second network element can obtain security context 4 and security Context 5, and the security context 4 and the security context 5 are used to protect the Qos flow 2 of the PDU session 2 and the Qos flow 1 of the PDU session 3, respectively.
  • the first message further includes an identifier of the terminal, so that the second network element determines the terminal that switches the secure transmission path.
  • the identification of the terminal can be: IP address, permanent equipment identifier (PEI), user permanent identifier (SUPI), subscription concealed identifier (SUCI), temporary mobile customer identification code ( Temporary mobile subscriber identifier (TMSI), IP multimedia public identifier (IMPU), media access control (MAC) address, mobile phone number and globally unique temporary identifier (globally unique) temporary identifier UE identity , Referred to as at least one of GUTI), is not limited here.
  • the GUTI in the 4G communication system is generally called GUTI directly, and the GUTI in the 5G communication system is generally called 5G GUTI.
  • PEI is the fixed identification of the terminal.
  • SUPI is the permanent identification of the user.
  • SUCI is the user ID after encrypting SUPI.
  • the first network element is SMF
  • the second network element is UPF
  • the DN or RAN node can determine the safe transmission path of the switching terminal
  • the information received by the UPF indicating the switching of the secure transmission path of the terminal may not be sent by the SMF, but sent by the DN or RAN node.
  • the information indicating the switching of the secure transmission path of the terminal may be carried in the uplink data packet or the downlink data packet of the terminal.
  • the first message received by the UPF may not be sent by the SMF, but sent by the AMF.
  • the first network element is an AMF
  • the second network element is a RAN node
  • the first indication information is at least used to indicate a target security endpoint
  • the target security endpoint is UPF
  • the first message A further includes the upstream tunnel endpoint of the UPF Identification (tunnel endpoint identifier, TEID for short).
  • the above method further includes: the second network element sends data of the first service flow belonging to the at least one session or the first session or the first session to the UPF through the tunnel indicated by the uplink TEID, the at least one session, The first session and the first service flow of the first session respectively use target security contexts corresponding to the at least one session, the first session, and the first service flow of the first session for security protection.
  • the data of which session or service flow the second network element sends to the UPF through the tunnel indicated by the upstream TEID depends on the session or service flow for switching the secure transmission path determined by the first network element in the foregoing embodiment.
  • the RAN node when the target security endpoint is the UPF after the UPF reselection is completed, the RAN node does not know which tunnel to send to the new UPF (that is, the UPF after the UPF reselection is completed) Data, in this case, the first message A may also include the uplink TEID of the UPF, so that the RAN node sends data to the new UPF.
  • the above method may further include the following optional method 2 to optional method 5.
  • Optional (marked as optional method 2), the above method also includes:
  • the RAN node sends a second message to the terminal according to the first message A, where the second message is used to instruct to switch the terminal's secure transmission path.
  • the terminal receives the second message from the RAN node.
  • the terminal switches the security context of at least one session of the terminal from the source security context to the target security context according to the second message.
  • the source security context of a session is the security context used by the terminal when the data belonging to the session is transmitted on the source secure transmission path
  • the target security context of a session is the terminal when the data belonging to the session is transmitted on the target secure transmission path The security context used.
  • the terminal transmits data belonging to at least one session on the target secure transmission path according to the target security context of the at least one session.
  • the second message may be an RRC message or other air interface or non-access stratum message that can transfer the information in the second message.
  • the second message may be an RRC reconfiguration message, a security activation message, and so on.
  • the second message may also be referred to as a switching request, a safety endpoint switching request, a safety transmission path switching request, etc.
  • the second message may be understood as a message informing the safety transmission path switching, and the message name may be different according to a specific business scenario.
  • the terminal may search for the target security context of at least one session from the stored security contexts, or may generate the target security context of at least one session by itself. After step 306, the terminal may reconfigure at least one session. Further, after the terminal reconfigures at least one session, the terminal may immediately activate the integrity protection and/or encryption of the at least one session, or may activate the integrity protection and/or at least one session when the user plane data is officially transmitted Encryption may also activate the integrity protection and/or encryption of at least one session after completing the communication with the network in terms of signaling connection.
  • the method may further include that the terminal sends a response of the second message to the RAN node, and the response of the second message is used to indicate that the terminal has completed the configuration of the security context of the secure transmission path.
  • the terminal may perform security protection on at least one session according to the target security context of the at least one session of the terminal.
  • the second message includes the first indication information.
  • the above method further includes:
  • the terminal determines the source safe transmission path according to the first indication information in the second message; or,
  • the terminal determines the target safe transmission path according to the first indication information in the second message; or,
  • the terminal determines the source safe transmission path and the target safe transmission path according to the first indication information in the second message; or,
  • the terminal determines the source security endpoint according to the first indication information in the second message; or,
  • the terminal determines the target security endpoint according to the first indication information in the second message; or,
  • the terminal determines the source security endpoint and the target security endpoint according to the first indication information in the second message.
  • the second message in the case where the first message A further includes the identifier of the first session, the second message also includes the identifier of the first session, and the second message is specifically used to indicate the first A secure transmission path for a session.
  • the at least one session is the first session.
  • One session may include one or more service flows.
  • one session may correspond to one UE-RAN security context and one UE-UPF security context.
  • the service flow as a Qos flow, and the terminal's secure transmission path switching from the UE-RAN secure transmission path to the UE-UPF secure transmission path as an example, see Table 3.
  • the terminal may switch the security context of PDU session 1 from UE-RAN security context 1 to UE-UPF security context 1, and use UE-UPF security context 1 to protect PDU session 1. .
  • the terminal may switch the security context of PDU session 2 from UE-RAN security context 2 to UE-UPF security context 2, and the security context of PDU session 3 from UE-RAN
  • the security context 3 is switched to the UE-UPF security context 3, and the UE-UPF security context 2 and the UE-UPF security context 3 are used to protect the PDU session 2 and the PDU session 3, respectively.
  • the second message in the case where the first message A further includes the identifier of the first service flow of the first session, the second message also includes the identifier of the first service flow of the first session, The second message is specifically used to instruct to switch the secure transmission path of the first service flow.
  • step 306 when specifically implemented, may include: the terminal switching the security context of the first service flow of the first session from the source security context to the target security context according to the second message; the source security context of a service flow belongs to The security context used by the terminal when the data of the service flow is transmitted on the source secure transmission path, and the target security context of a service flow is the security context used by the terminal when the data belonging to the service flow is transmitted on the target secure transmission path.
  • step 307 it may include that the terminal transmits the data of the first service flow belonging to the first session on the target secure transmission path according to the target security context of the first service flow of the first session.
  • the terminal may reconfigure the first service flow of the first session. Further, after the terminal reconfigures the first service flow of the first session, the terminal can immediately activate the integrity protection and/or encryption of the first service flow of the first session, or can be activated when the user plane data is officially transmitted. The integrity protection and/or encryption of the first service flow of the first session may also be activated after the communication with the network in terms of signaling connection is completed.
  • all business flows of a session can correspond to a security context.
  • the service flow as a Qos flow
  • the terminal may switch the security context of Qos flow 1 of PDU session 1 from UE-RAN security context 1 to UE -UPF security context 1, and uses UE-UPF security context 1 to secure the Qos flow 1 of PDU session 1.
  • the terminal can change the Qos flow 2 of PDU session 2
  • the security context is switched from UE-RAN security context 2 to UE-UPF security context 2
  • the security context of Qos flow 1 of PDU session 3 is switched from UE-RAN security context 3 to UE-UPF security context 3, and UE-UPF is adopted
  • the security context 2 and the UE-UPF security context 3 respectively protect the Qos flow 2 of the PDU session 2 and the Qos flow 1 of the PDU session 3.
  • multiple service flows of a session may also correspond to a security context.
  • the service flow as a Qos flow, and the terminal's secure transmission path switching from the UE-RAN secure transmission path to the UE-UPF secure transmission path as an example, see Table 4.
  • the terminal may switch the security context of Qos flow 1 of PDU session 1 from UE-RAN security context 1 to UE -UPF security context 1, and uses UE-UPF security context 1 to secure the Qos flow 1 of PDU session 1.
  • the terminal can change the Qos flow 2 of PDU session 2
  • the security context is switched from the UE-RAN security context 4 to the UE-UPF security context 4, and the security context of the Qos flow 1 of the PDU session 3 is switched from the UE-RAN security context 5 to the UE-UPF security context 5, and the UE-UPF is adopted
  • the security context 4 and the UE-UPF security context 5 respectively protect the Qos flow 2 of the PDU session 2 and the Qos flow 1 of the PDU session 3.
  • the terminal and the RAN node can use the correct security context to securely protect the data belonging to the session.
  • the second network element may be UPF After the UPF is reselected, the UPF before the UPF reselection can release the session that needs to be switched over in a secure transmission path.
  • the method provided in this embodiment of the present application can also be directly applied to a business flow.
  • the “session” in the above embodiment can be replaced with a “business flow”, and the foregoing optional method 1 and optional method 5 No need to execute.
  • the AMF determines that the secure transmission path of the terminal's first session is switched from the UE-RAN secure transmission path to the UE-UPF secure transmission path.
  • the AMF sends second indication information to the SMF.
  • the second indication information is used to instruct the terminal to switch the secure transmission path of the first session from the UE-RAN secure transmission path to the UE-UPF secure transmission path.
  • the SMF receives the second indication information from the AMF.
  • SMF performs UPF selection.
  • the SMF may determine to reselect the UPF, the UPF before the reselection is recorded as UPF1, and the UPF after the reselection is recorded as UPF2.
  • the SMF will select a new UPF (ie, UPF2) or PDU Session Anchor (PSA) to serve the terminal.
  • SMF can select UPF according to UPF selection rules (UPF selection criteria).
  • UPF selection rule includes at least: the selected UPF supports the UE-UPF secure transmission path.
  • the SMF determines that the secure transmission path of the first session of the terminal is switched from the UE-RAN secure transmission path to the UE-UPF secure transmission path according to the second instruction information.
  • step 703 and step 704 is in no particular order.
  • the SMF may notify UPF1 to release the first session.
  • the SMF sends an N4 session modification request to UPF1.
  • UPF1 After releasing the first session according to the N4 session modification request, UPF1 sends an N4 session modification response (N4 Session Modification Response) to the SMF.
  • the N4 session modification response is used to instruct UPF1 to release the completion of the first session.
  • the SMF sends a first message B to UPF2.
  • the first message B is used to instruct to switch the secure transmission path of the terminal's first session from the UE-RAN secure transmission path to the UE-UPF secure transmission path.
  • UPF2 receives the first message B from the SMF.
  • the first message B may include the identifier of the first session, and may also include the first indication information.
  • UPF2 obtains the security context of the first session according to the first message B, and uses the security context of the first session to perform security protection on the first session.
  • the AMF sends a first message A to the RAN node.
  • the first message A is used to instruct to switch the secure transmission path of the terminal's first session from the UE-RAN secure transmission path to the UE-UPF secure transmission path.
  • the RAN node receives the first message A from the AMF.
  • the first message A may include the identifier of the first session and the first indication information.
  • the RAN node deletes the security context of the first session according to the first message A.
  • the RAN node sends a second message to the terminal according to the first message A.
  • the second message is used to instruct to switch the secure transmission path of the first session of the terminal from the UE-RAN secure transmission path to the UE-UPF secure transmission path.
  • the terminal receives the second message from the RAN node.
  • the second message may include the identifier of the first session and the first indication information.
  • the terminal switches the security context of the first session from the source security context to the target security context according to the second message.
  • the terminal transmits data belonging to the first session according to the target security context of the first session.
  • UPF1 may also determine to reselect the UPF. At this time, UPF1 performs UPF selection and sends a reselection instruction to the SMF and the selected UPF2. The reselection instruction is used to indicate that the UPF is reselected to UPF2. In this case, step 703 may not be executed, and UPF1 may release the session by itself without relying on the N4 session modification request sent by the SMF.
  • each network element for example, a mobility management network element, a session management network element, a terminal, an access network node, or a user plane network element, includes the hardware structure and /Or software module.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed by hardware or computer software driven hardware depends on the specific application of the technical solution and design constraints. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
  • the embodiments of the present application may divide the functional units of the mobility management network element, the session management network element, the terminal, the access network node, or the user plane network element according to the above method example, for example, each functional unit may be divided corresponding to each function, It is also possible to integrate two or more functions in one processing unit.
  • the above integrated unit can be implemented in the form of hardware or software function unit. It should be noted that the division of the units in the embodiments of the present application is schematic, and is only a division of logical functions. In actual implementation, there may be another division manner.
  • FIG. 8 shows a possible structural schematic diagram of a device for switching transmission paths (referred to as a device 80 for switching transmission paths) involved in the above embodiment.
  • the device for switching transmission paths 80 includes a processing unit 801 and a communication unit 802, and may further include a storage unit 803.
  • the structural schematic diagram shown in FIG. 8 may be used to illustrate the structure of the mobility management network element, session management network element, terminal, access network node, or user plane network element involved in the foregoing embodiments.
  • the processing unit 801 is used to control and manage the actions of the mobility management network element.
  • the processing unit 801 is used to support the mobility management network element to perform steps 300a, 301a, and 302a in FIGS. 3 and 4, step 301a, step 300b, and 302a in FIGS. 5 and 6, and FIG. 7 Steps 701, 702, and 707, and/or actions performed by the mobility management network element in other processes described in the embodiments of the present application.
  • the processing unit 801 may communicate with other network entities through the communication unit 802, for example, communication with the session management network element (ie, SMF) shown in FIG.
  • the storage unit 803 is used to store program codes and data of the mobility management network element.
  • the device 80 for switching the transmission path may be a mobility management network element or may be within the mobility management network element Chip.
  • the processing unit 801 is used to control and manage the actions of the session management network element.
  • the processing unit 801 is used to support the session management network element to perform step 301b, step 300a, and step 302b in FIGS. 3 and 4, step 300b, step 301b, and step 302b in FIGS. 5 and 6, step in FIG. 7. Steps 702 to 705, and/or actions performed by the session management network element in other processes described in the embodiments of the present application.
  • the processing unit 801 may communicate with other network entities through the communication unit 802, for example, with the mobility management network element (ie, AMF) shown in FIG.
  • the storage unit 803 is used to store program codes and data of the session management network element.
  • the device 80 for switching the transmission path may be a session management network element or a chip in the session management network element.
  • the processing unit 801 is used to Control and manage the operation of the plane gateway.
  • the processing unit 801 is used to support the user plane gateway to perform steps 302b and 304b in FIGS. 3 and 5, step 302b and step 303b in FIGS. 4 and 6, step 705 and step 706 in FIG. 7, and/or Or actions performed by the user plane gateway in other processes described in the embodiments of the present application.
  • the processing unit 801 may communicate with other network entities through the communication unit 802, for example, communication with the session management network element (ie, SMF) shown in FIG.
  • the storage unit 803 is used to store program codes and data of the user plane gateway.
  • the device 80 for switching the transmission path may be a user plane gateway or a chip in the user plane gateway.
  • the processing unit 801 is used to control and manage the actions of the access network node.
  • the processing unit 801 is used to support the access network node to perform steps 302a, 303a, and 305 in FIGS. 3 and 5, steps 302a, 304a, and 305 in FIGS. 4 and 6, and steps in FIG. 7 707 to step 709, and/or actions performed by the access network node in other processes described in the embodiments of the present application.
  • the processing unit 801 may communicate with other network entities through the communication unit 802, for example, communication with the terminal shown in FIG.
  • the storage unit 803 is used to store the program code and data of the access network node.
  • the device 80 for switching the transmission path may be an access network node or a chip in the access network node.
  • the processing unit 801 is used to control and manage the operation of the terminal.
  • the processing unit 801 is used to support the terminal to perform steps 305, 306, and 307 in FIGS. 3 to 6, step 709 to step 711 in FIG. 7, and/or other processes described in the embodiments of the present application. Actions performed by the terminal.
  • the processing unit 801 may communicate with other network entities through the communication unit 802, for example, communication with the access network node (ie, RAN node) shown in FIG.
  • the storage unit 803 is used to store program codes and data of the terminal.
  • the device 80 for switching the transmission path may be a terminal or a chip in the terminal.
  • the communication unit may also be called a transceiver unit.
  • the antenna and the control circuit in the device 80 for switching the transmission path can be regarded as the communication unit 802 of the device 80 for switching the transmission path, and the processor with the processing function can be regarded as the processing unit 801 of the device 80 for switching the transmission path.
  • the device for realizing the receiving function in the communication unit 802 may be regarded as a receiving unit.
  • the receiving unit is used to perform the receiving step in the embodiment of the present application.
  • the receiving unit may be a receiver, a receiver, a receiving circuit, and the like.
  • the device used to implement the transmission function in the communication unit 802 may be regarded as a transmission unit.
  • the transmission unit is used to perform the transmission steps in the embodiments of the present application.
  • the transmission unit may be a transmitter, a transmitter, a transmission circuit, or the like.
  • the integrated unit in FIG. 8 may be stored in a computer-readable storage medium.
  • the technical solutions of the embodiments of the present application may essentially be a part that contributes to the existing technology or all or part of the technical solutions may be embodied in the form of software products, and the computer software products are stored in a storage
  • the medium includes several instructions to enable a computer device (which may be a personal computer, server, etc.) or processor to execute all or part of the steps of the methods described in the embodiments of the present application.
  • Storage media for storing computer software products include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc. Program code medium.
  • the unit in the embodiment of the present application may also be called a module, for example, the processing unit may be called a processing module.
  • the apparatus for switching transmission paths may be a mobility management network element, a session management network element, a terminal, an access network node or User plane network element.
  • the transmission path switching device 90 includes at least one processor 901, a communication bus 902, and at least one communication interface 904.
  • the memory 903 is also included.
  • a device 90 for switching transmission paths includes a processor 901 and a communication interface 904 as an example for drawing.
  • the processor 901, the communication interface 904 and the memory 903 can be connected through a communication bus 902 to communicate with each other and transfer control and/or data signals.
  • the memory 903 is used to store a computer program, and the processor 901 is used from the memory 903 Call and run the computer program to control the communication interface 904 to send and receive signals.
  • the processor 901 may be a general-purpose central processing unit (central processing unit, CPU for short), a microprocessor, an application-specific integrated circuit (application-specific integrated circuit, ASIC for short), or a Or multiple integrated circuits for controlling the execution of the program procedures of this application.
  • the communication interface 904 may be any device such as a transceiver.
  • the processor 901 may be a logic circuit
  • the communication interface 904 may include an input interface and an output interface.
  • the memory 903 may be ROM or other types of static storage devices that can store static information and instructions, RAM or other types of dynamic storage devices that can store information and instructions, or electrically erasable programmable read-only memory (electrically erasable programmable memory) read-only memory (EEPROM), compact disc-read memory (CD-ROM) or other optical disk storage, optical disk storage (including compact disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.) , Disk storage media or other magnetic storage devices, or any other media that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.
  • the memory may exist independently, and is connected to the processor through the communication bus 902. The memory can also be integrated with the processor.
  • the memory 903 is used to store computer execution instructions for executing the solution of the present application, and the processor 901 controls execution.
  • the processor 901 is used to execute computer-executed instructions stored in the memory 903, so as to implement the method provided by the foregoing embodiments of the present application.
  • the computer execution instructions in the embodiments of the present application may also be called application program codes, which are not specifically limited in the embodiments of the present application.
  • the processor 901 is used to control and manage the actions of the mobility management network element.
  • the processor 901 is used to support the mobility management network element to perform steps 300a, 301a, and 302a in FIGS. 3 and 4, step 301a, step 300b, and 302a in FIGS. 5 and 6, and FIG. 7 Steps 701, 702, and 707, and/or actions performed by the mobility management network element in other processes described in the embodiments of the present application.
  • the processor 901 may communicate with other network entities through the communication interface 904, for example, with the session management network element (ie, SMF) shown in FIG.
  • the memory 903 is used to store program codes and data of the mobility management network element.
  • the processor 901 is used to control and manage the actions of the session management network element.
  • the processor 901 is used to support the session management network element to perform step 301b, step 300a and step 302b in FIGS. 3 and 4, step 300b, step 301b and step 302b in FIGS. 5 and 6, step in FIG. 7. Steps 702 to 705, and/or actions performed by the session management network element in other processes described in the embodiments of the present application.
  • the processor 901 may communicate with other network entities through the communication interface 904, for example, with the mobility management network element (ie, AMF) shown in FIG.
  • the memory 903 is used to store program codes and data of the session management network element.
  • the processor 901 is used to The operations of the plane gateway are controlled and managed.
  • the processor 901 is used to support the user plane gateway to perform steps 302b and 304b in FIGS. 3 and 5, steps 302b and 303b in FIGS. 4 and 6, and FIG. 7. Step 705 and step 706, and/or actions performed by the user plane gateway in other processes described in the embodiments of the present application.
  • the processor 901 may communicate with other network entities through the communication interface 904, for example, with the session management network element (ie, SMF) shown in FIG.
  • the memory 903 is used to store program codes and data of the user plane gateway.
  • the processor 901 is used to control and manage the actions of the access network node, for example, The processor 901 is used to support the access network node to perform step 302a, step 303a and step 305 in FIG. 3 and FIG. 5, step 302a, step 304a and step 305 in FIG. 4 and FIG. 6, step 707 to step 707 in FIG. Step 709, and/or actions performed by the access network node in other processes described in the embodiments of the present application.
  • the processor 901 may communicate with other network entities through the communication interface 904, for example, communication with the terminal shown in FIG.
  • the memory 903 is used to store program codes and data of access network nodes.
  • the processor 901 is used to control and manage the actions of the terminal.
  • the processor 901 is used to support the terminal to execute FIGS. Step 305, step 306, and step 307 in FIG. 6, step 709 to step 711 in FIG. 7, and/or actions performed by the terminal in other processes described in the embodiments of the present application.
  • the processor 901 may communicate with other network entities through the communication interface 904, for example, with the access network node (ie, RAN node) shown in FIG.
  • the memory 903 is used to store program codes and data of the terminal.
  • the embodiment of the present application also provides a schematic diagram of the hardware structure of a terminal (denoted as terminal 100) and an access network node (denoted as access network node 110). See Figure 10 for details.
  • the terminal 100 includes at least one processor 1001 and at least one transceiver 1003. Optionally, at least one memory 1002 is also included. Optionally, the terminal 100 further includes at least one antenna 1004. Optionally, the terminal 100 further includes an output device 1005 and/or an input device 1006.
  • the processor 1001 is used to control and manage the actions of the terminal.
  • the processor 1001 is used to support the terminal to perform steps 305, 306, and 307 in FIG. 3 to FIG. 6, step 709 to step 711 in FIG. 7, and And/or actions performed by the terminal in other processes described in the embodiments of the present application.
  • the processor 1001 may communicate with other network entities through the transceiver 1003, for example, with the RAN node shown in FIG.
  • the memory 1002 is used to store program codes and data of the terminal.
  • the processor 1001 and the memory 1002 reference may be made to the description of the processor 901 and the memory 903, respectively, and details are not described herein again.
  • the function of the transceiver 1003 is similar to that of the communication interface 904.
  • the description of the transceiver 1003 reference may be made to the description of the communication interface 904, which will not be repeated here.
  • the output device 1005 communicates with the processor 1001 and can display information in various ways.
  • the output device 1005 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) etc.
  • the input device 1006 communicates with the processor 1001 and can receive user input in various ways.
  • the input device 1006 may be a mouse, a keyboard, a touch screen device, or a sensing device.
  • the transceiver 1003 may include a transmitter 10031 and a receiver 10032.
  • the device used to implement the receiving function in the transceiver 1003 can be regarded as a receiver 10032, and the receiver 10032 is used to perform the receiving step in the embodiment of the present application.
  • the device in the transceiver 1003 for implementing the sending function may be regarded as a transmitter 10031, and the transmitter 10031 is used to perform the sending step in the embodiment of the present application.
  • the access network node 110 includes at least one processor 1101 and at least one transceiver 1103. Optionally, at least one memory 1102 is also included. Optionally, the access network node 110 further includes at least one antenna 1104.
  • the processor 1101 is used to control and manage the actions of the access network node.
  • the processor 1101 is used to support the access network node to perform steps 302a, 303a, and 305 in FIGS. 3 and 5, and FIGS. 4 and 6 Steps 302a, 304a, and 305 in FIG. 7, steps 707 to 709 in FIG. 7, and/or actions performed by the access network node in other processes described in the embodiments of the present application.
  • the processor 1101 may communicate with other network entities through the transceiver 1103, for example, communication with the terminal shown in FIG.
  • the memory 1102 is used to store program codes and data of access network nodes.
  • the processor 1101, the memory 1102 and the transceiver 1103 are connected through a communication bus 1102.
  • the function of the transceiver 1103 is similar to that of the communication interface 904.
  • the description of the transceiver 1103, please refer to the description of the communication interface 904, which will not be repeated here.
  • the transceiver 1103 may include a transmitter 11031 and a receiver 11032.
  • the device in the transceiver 1103 for implementing the receiving function may be regarded as a receiver 11032, and the receiver 11032 is used to perform the receiving step in the embodiment of the present application.
  • the device in the transceiver 1103 for implementing the sending function may be regarded as a transmitter 11031, and the transmitter 11031 is used to perform the sending step in the embodiment of the present application.
  • the processor may include a baseband processor and a central processor.
  • the baseband processor is mainly used to process communication protocols and communication data, and the central processor mainly Used to control the entire device, execute software programs, and process software program data.
  • the processor integrates the functions of the baseband processor and the central processor.
  • the baseband processor and the central processor can also be separate processors, which are interconnected through a bus and other technologies.
  • the baseband processor can also be expressed as a baseband processing circuit or a baseband processing chip.
  • the central processor can also be expressed as a central processing circuit or a central processing chip.
  • the function of processing the communication protocol and the communication data may be built in the processor, or may be stored in the storage unit in the form of a software program, and the processor executes the software program to realize the baseband processing function.
  • An embodiment of the present application also provides a computer-readable storage medium, including instructions, which when executed on a computer, causes the computer to perform any of the above methods.
  • Embodiments of the present application also provide a computer program product containing instructions, which when run on a computer, causes the computer to execute any of the above methods.
  • An embodiment of the present application also provides an apparatus, which exists in the form of a chip product.
  • the apparatus includes a processor, a memory, and a transceiver component.
  • the transceiver component includes an input and output circuit.
  • the memory is used to store computer-executed instructions.
  • the computer executes instructions stored in the memory to implement any of the above methods.
  • the execution subject that executes the method provided by the embodiments of the present application may be a chip.
  • An embodiment of the present application further provides a communication system, including the foregoing mobility management network element, session management network element, terminal, access network node, and user plane network element.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable devices.
  • Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions can be transmitted from a website, computer, server, or data center via a wired (e.g.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device including one or more servers and data centers that can be integrated with the medium.
  • the usable media may be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media (for example, DVD), or semiconductor media (for example, solid state disk (SSD)) and the like.

Abstract

本申请提供了一种切换传输路径的方法及装置，涉及通信技术领域。该方法包括：终端从接入网节点接收用于指示切换终端的安全传输路径的第二消息，根据第二消息将终端的至少一个会话的安全上下文从源安全上下文切换至目标安全上下文，并根据至少一个会话的目标安全上下文在目标安全传输路径上传输属于至少一个会话的数据。该方法可以实现终端的安全传输路径的切换，从而在不同的场景中，选择是否切换终端的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。

Description

切换传输路径的方法及装置 技术领域
本申请涉及通信技术领域，尤其涉及一种切换传输路径的方法及装置。
背景技术
移动通信的安全问题正越来越多地受到关注。在数据传输过程中，发送端可以对传输的数据进行加密保护和完整性保护，接收端可以对接收到的加密数据进行解密和完整性验证，从而实现数据的安全保护。
目前，数据的安全保护可以在终端和基站之间进行，以上行传输为例，终端可以在完成对数据的加密和完整性保护后发送至基站，基站可以负责数据解密和完整性验证。数据的安全保护也可以在终端和用户面功能(user plane function，简称UPF)之间进行，以上行传输为例，终端可以在完成对数据的加密和完整性保护后通过基站发送至UPF，UPF可以负责数据解密和完整性验证。当固定的在终端和基站之间，或者，终端和UPF之间对数据进行安全保护时，数据的安全保护无法适应不断变化的网络场景。
发明内容
本申请实施例提供了一种切换传输路径的方法及装置，用于使得数据的安全保护灵活的适应不断变化的网络场景。
为达到上述目的，本申请实施例提供了如下技术方案：
第一方面，提供了一种切换传输路径的方法，包括：终端从接入网节点接收用于指示切换终端的安全传输路径的第二消息，根据第二消息将终端的至少一个会话的安全上下文从源安全上下文切换至目标安全上下文，并根据至少一个会话的目标安全上下文在目标安全传输路径上传输属于至少一个会话的数据。
其中，终端的安全传输路径包括第一安全传输路径和第二安全传输路径，第一安全传输路径是安全终结点为接入网节点和终端的用户面传输路径，第二安全传输路径是安全终结点为用户面网关和终端的用户面传输路径，安全终结点为对终端的用户面数据进行安全保护的节点；一个会话的源安全上下文为属于该会话的数据在源安全传输路径上传输时终端所使用的安全上下文，一个会话的目标安全上下文为属于该会话的数据在目标安全传输路径上传输时终端所使用的安全上下文；源安全传输路径为切换终端的安全传输路径之前终端的安全传输路径；目标安全传输路径为切换终端的安全传输路径之后终端的安全传输路径。
第一方面提供的方法，可以实现终端的第一安全传输路径和第二安全传输路径之间的切换，从而在不同的场景中，选择是否切换终端的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。
在一种可能的实现方式中，第二消息中包括第一指示信息；第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，源安全终结点为源安全传输路径的安全终结点；目标 安全终结点为目标安全传输路径的安全终结点，源安全终结点和目标安全终结点中一个为接入网节点，另一个为用户面网关，该方法还包括：在第一指示信息用于指示源安全传输路径的情况下，终端根据第二消息中的第一指示信息确定源安全传输路径；或者，在第一指示信息用于指示目标安全传输路径的情况下，终端根据第二消息中的第一指示信息确定目标安全传输路径；或者，在第一指示信息用于指示源安全传输路径和目标安全传输路径的情况下，终端根据第二消息中的第一指示信息确定源安全传输路径和目标安全传输路径；或者，在第一指示信息用于指示源安全终结点的情况下，终端根据第二消息中的第一指示信息确定源安全终结点；或者，在第一指示信息用于指示目标安全终结点的情况下，终端根据第二消息中的第一指示信息确定目标安全终结点；或者，在第一指示信息用于指示源安全终结点和目标安全终结点的情况下，终端根据第二消息中的第一指示信息确定源安全终结点和目标安全终结点。该种可能的实现方式，可以使得终端确定源安全传输路径和/或目标安全传输路径；或者，确定源安全终结点和/或目标安全终结点。
在一种可能的实现方式中，第二消息还包括第一会话的标识，第二消息具体用于指示切换终端的第一会话的安全传输路径，至少一个会话为第一会话。该种可能的实现方式，可以针对某个会话切换安全传输路径，从而在不同的场景中，选择是否切换终端的某个会话的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。
在一种可能的实现方式中，第二消息还包括第一会话的第一业务流的标识，此时，第二消息具体用于指示切换终端的第一会话的第一业务流的安全传输路径；终端根据第二消息将终端的至少一个会话的安全上下文从源安全上下文切换至目标安全上下文，包括：终端根据第二消息将第一会话的第一业务流的安全上下文从源安全上下文切换至目标安全上下文；一个业务流的源安全上下文为属于该业务流的数据在源安全传输路径上传输时终端所使用的安全上下文，一个业务流的目标安全上下文为属于该业务流的数据在目标安全传输路径上传输时终端所使用的安全上下文；终端根据至少一个会话的目标安全上下文在目标安全传输路径上传输属于至少一个会话的数据，包括：终端根据第一会话的第一业务流的目标安全上下文在目标安全传输路径上传输属于第一会话的第一业务流的数据。该种可能的实现方式，可以针对某个业务流切换安全传输路径，从而在不同的场景中，选择是否切换终端的某个业务流的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。
第二方面，提供了一种切换传输路径的方法，包括：第一网元确定切换终端的安全传输路径，并向第二网元发送用于指示切换终端的安全传输路径的第一消息；第一网元为移动性管理网元，第二网元为接入网节点；或者，第一网元为会话管理网元，第二网元为用户面网关。
其中，终端的安全传输路径包括第一安全传输路径和第二安全传输路径，第一安全传输路径是安全终结点为接入网节点和终端的用户面传输路径，第二安全传输路径是安全终结点为用户面网关和终端的用户面传输路径，安全终结点为对终端的用户面数据进行安全保护的节点。
第二方面提供的方法，可以实现终端的第一安全传输路径和第二安全传输路径之 间的切换，从而在不同的场景中，选择是否切换终端的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。
在一种可能的实现方式中，第一消息包括第一指示信息；第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，源安全传输路径为切换终端的安全传输路径之前终端的安全传输路径；目标安全传输路径为切换终端的安全传输路径之后终端的安全传输路径；源安全终结点为源安全传输路径的安全终结点；目标安全终结点为目标安全传输路径的安全终结点，源安全终结点和目标安全终结点中一个为接入网节点，另一个为用户面网关。该种可能的实现方式，可以使得第二网元确定源安全传输路径和/或目标安全传输路径；或者，确定源安全终结点和/或目标安全终结点。
在一种可能的实现方式中，第一消息还包括第一会话的标识，第一消息具体用于指示切换终端的第一会话的安全传输路径。该种可能的实现方式，可以针对某个会话切换安全传输路径，从而在不同的场景中，选择是否切换终端的某个会话的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。
在一种可能的实现方式中，第一消息还包括第一会话的第一业务流的标识，第一消息具体用于指示切换第一业务流的安全传输路径。该种可能的实现方式，可以针对某个业务流切换安全传输路径，从而在不同的场景中，选择是否切换终端的某个业务流的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。
在一种可能的实现方式中，第二网元为接入网节点，第一指示信息至少用于指示目标安全终结点，目标安全终结点为用户面网关，第一消息还包括用户面网关的上行TEID。该种可能的实现方式，可以使得接入网节点确定采用的隧道，以便正确的将数据传输至用户面网关。
在一种可能的实现方式中，第一网元确定切换终端的安全传输路径，包括：第一网元根据网络负载、网络运行和部署情况、本地策略、第三方策略、运营商策略、大数据分析结果中的一个或多个确定切换终端的安全传输路径；或者，第一网元接收第二指示信息并根据第二指示信息确定切换终端的安全传输路径，第二指示信息用于指示切换终端的安全传输路径。该种可能的实现方式，提供了多种确定切换安全传输路径的方法，以适应不同的业务场景。
第三方面，提供了一种切换传输路径的方法，包括：第二网元从第一网元接收用于指示切换终端的安全传输路径的第一消息，在目标安全传输路径的安全终结点包括第二网元的情况下，第二网元根据第一消息获取终端的至少一个会话的安全上下文，并采用至少一个会话的安全上下文对至少一个会话进行安全保护。
其中，终端的安全传输路径包括第一安全传输路径和第二安全传输路径，第一安全传输路径是安全终结点为接入网节点和终端的用户面传输路径，第二安全传输路径是安全终结点为用户面网关和终端的用户面传输路径，安全终结点为对终端的用户面数据进行安全保护的节点；其中，第一网元为移动性管理网元，第二网元为接入网节点；或者，第一网元为会话管理网元，第二网元为用户面网关；至少一个会话为从源安全传输路径切换到目标安全传输路径的会话，源安全传输路径为切换终端的安全传输路径之前终端的安全传输路径；目标安全传输路径为切换终端的安全传输路径之后 终端的安全传输路径。
第三方面提供的方法，可以实现终端的第一安全传输路径和第二安全传输路径之间的切换，从而在不同的场景中，选择是否切换终端的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。
在一种可能的实现方式中，该方法还包括：在目标安全传输路径的安全终结点不包括第二网元的情况下，第二网元根据第一消息删除至少一个会话的安全上下文。该种可能的实现方式，可以节约第二网元的存储资源。
在一种可能的实现方式中，第一消息包括第一指示信息；第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，源安全终结点为源安全传输路径的安全终结点；目标安全终结点为目标安全传输路径的安全终结点，源安全终结点和目标安全终结点中一个为接入网节点，另一个为用户面网关，该方法还包括：在第一指示信息用于指示源安全传输路径的情况下，第二网元根据第一消息中的第一指示信息确定源安全传输路径；或者，在第一指示信息用于指示目标安全传输路径的情况下，第二网元根据第一消息中的第一指示信息确定目标安全传输路径；或者，在第一指示信息用于指示源安全传输路径和目标安全传输路径的情况下，第二网元根据第一消息中的第一指示信息确定源安全传输路径和目标安全传输路径；或者，在第一指示信息用于指示源安全终结点的情况下，第二网元根据第一消息中的第一指示信息确定源安全终结点；或者，在第一指示信息用于指示目标安全终结点的情况下，第二网元根据第一消息中的第一指示信息确定目标安全终结点；或者，在第一指示信息用于指示源安全终结点和目标安全终结点的情况下，第二网元根据第一消息中的第一指示信息确定源安全终结点和目标安全终结点。该种可能的实现方式，可以使得第二网元确定源安全传输路径和/或目标安全传输路径；或者，确定源安全终结点和/或目标安全终结点。
在一种可能的实现方式中，第一消息还包括第一会话的标识，第一消息具体用于指示切换终端的第一会话的安全传输路径，至少一个会话为第一会话。该种可能的实现方式，可以针对某个会话切换安全传输路径，从而在不同的场景中，选择是否切换终端的某个会话的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。
在一种可能的实现方式中，第一消息还包括第一会话的第一业务流的标识，第一消息具体用于指示切换终端的第一会话的第一业务流的安全传输路径；第二网元根据第一消息获取终端的至少一个会话的安全上下文，包括：第二网元根据第一消息获取第一会话的第一业务流的安全上下文。该种可能的实现方式，可以针对某个业务流切换安全传输路径，从而在不同的场景中，选择是否切换终端的某个业务流的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。
在一种可能的实现方式中，第一消息还包括第一会话的第一业务流的标识，第一消息具体用于指示切换终端的第一会话的第一业务流的安全传输路径，在目标安全传输路径的安全终结点不包括第二网元的情况下；第二网元根据第一消息删除至少一个会话的安全上下文，包括：第二网元根据第一消息删除第一会话的第一业务流的安全上下文。
在一种可能的实现方式中，第二网元为接入网节点，第一指示信息至少用于指示目标安全终结点，目标安全终结点为用户面网关，第一消息还包括用户面网关的上行TEID，该方法还包括：第二网元通过上行TEID指示的隧道向用户面网关发送属于至少一个会话的数据，至少一个会话采用至少一个会话的安全上下文进行安全保护。
在一种可能的实现方式中，第二网元为接入网节点，该方法还包括：第二网元根据第一消息向终端发送第二消息，第二消息用于指示切换终端的安全传输路径。该种可能的实现方式，可以指示终端切换安全传输路径，从而使得终端切换安全上下文，保证数据的正确传输。
在一种可能的实现方式中，在第一消息包括第一指示信息的情况下，第二消息包括第一指示信息。该种可能的实现方式，可以使得终端确定源安全传输路径和/或目标安全传输路径；或者，确定源安全终结点和/或目标安全终结点。
在一种可能的实现方式中，在第一消息还包括第一会话的标识的情况下，第二消息还包括第一会话的标识，第二消息具体用于指示切换终端的第一会话的安全传输路径。该种可能的实现方式，可以针对某个会话切换安全传输路径，从而在不同的场景中，使得终端切换会话的安全上下文，保证数据的正确传输。
在一种可能的实现方式中，在第一消息还包括第一会话的第一业务流的标识的情况下，第二消息还包括第一会话的第一业务流的标识，第二消息具体用于指示切换第一业务流的安全传输路径。该种可能的实现方式，可以针对某个业务流切换安全传输路径，从而在不同的场景中，使得终端切换业务流的安全上下文，保证数据的正确传输。
第四方面，提供了一种切换传输路径的装置，包括：通信单元和处理单元；所述通信单元，用于从接入网节点接收第二消息，所述第二消息用于指示切换所述切换传输路径的装置的安全传输路径，所述切换传输路径的装置的安全传输路径包括第一安全传输路径和第二安全传输路径，所述第一安全传输路径是安全终结点为接入网节点和所述切换传输路径的装置的用户面传输路径，所述第二安全传输路径是安全终结点为用户面网关和所述切换传输路径的装置的用户面传输路径，所述安全终结点为对所述切换传输路径的装置的用户面数据进行安全保护的节点；所述处理单元，用于根据所述第二消息将所述切换传输路径的装置的至少一个会话的安全上下文从源安全上下文切换至目标安全上下文，一个会话的源安全上下文为属于该会话的数据在源安全传输路径上传输时所述切换传输路径的装置所使用的安全上下文，一个会话的目标安全上下文为属于该会话的数据在目标安全传输路径上传输时所述切换传输路径的装置所使用的安全上下文；所述源安全传输路径为切换所述切换传输路径的装置的安全传输路径之前所述切换传输路径的装置的安全传输路径；所述目标安全传输路径为切换所述切换传输路径的装置的安全传输路径之后所述切换传输路径的装置的安全传输路径；所述处理单元，还用于根据所述至少一个会话的目标安全上下文在所述目标安全传输路径上传输属于所述至少一个会话的数据。
在一种可能的实现方式中，所述第二消息中包括第一指示信息；所述第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，所述第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，所述源安全终结点为所述源安全传输路 径的安全终结点；所述目标安全终结点为所述目标安全传输路径的安全终结点，所述源安全终结点和所述目标安全终结点中一个为所述接入网节点，另一个为所述用户面网关；在所述第一指示信息用于指示所述源安全传输路径的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述源安全传输路径；或者，在所述第一指示信息用于指示所述目标安全传输路径的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述目标安全传输路径；或者，在所述第一指示信息用于指示所述源安全传输路径和所述目标安全传输路径的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述源安全传输路径和所述目标安全传输路径；或者，在所述第一指示信息用于指示所述源安全终结点的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述源安全终结点；或者，在所述第一指示信息用于指示所述目标安全终结点的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述目标安全终结点；或者，在所述第一指示信息用于指示所述源安全终结点和所述目标安全终结点的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述源安全终结点和所述目标安全终结点。
在一种可能的实现方式中，所述第二消息还包括第一会话的标识，所述第二消息具体用于指示切换所述切换传输路径的装置的所述第一会话的安全传输路径，所述至少一个会话为所述第一会话。
在一种可能的实现方式中，所述第二消息还包括所述第一会话的第一业务流的标识，所述第二消息具体用于指示切换所述切换传输路径的装置的所述第一会话的所述第一业务流的安全传输路径；所述处理单元，具体用于：根据所述第二消息将所述第一会话的所述第一业务流的安全上下文从源安全上下文切换至目标安全上下文；一个业务流的源安全上下文为属于该业务流的数据在源安全传输路径上传输时所述切换传输路径的装置所使用的安全上下文，一个业务流的目标安全上下文为属于该业务流的数据在目标安全传输路径上传输时所述切换传输路径的装置所使用的安全上下文；所述处理单元，具体用于：根据所述第一会话的所述第一业务流的目标安全上下文在所述目标安全传输路径上传输属于所述第一会话的所述第一业务流的数据。
第五方面，提供了一种切换传输路径的装置，包括：通信单元和处理单元；所述处理单元，用于确定切换终端的安全传输路径，所述终端的安全传输路径包括第一安全传输路径和第二安全传输路径，所述第一安全传输路径是安全终结点为接入网节点和所述终端的用户面传输路径，所述第二安全传输路径是安全终结点为用户面网关和所述终端的用户面传输路径，所述安全终结点为对所述终端的用户面数据进行安全保护的节点；所述通信单元，用于向第二网元发送第一消息，所述第一消息用于指示切换所述终端的安全传输路径；其中，所述切换传输路径的装置为移动性管理网元，所述第二网元为所述接入网节点；或者，所述切换传输路径的装置为会话管理网元，所述第二网元为所述用户面网关。
在一种可能的实现方式中，所述第一消息包括第一指示信息；所述第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，所述第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，所述源安全传输路径为切换所述终端的安 全传输路径之前所述终端的安全传输路径；所述目标安全传输路径为切换所述终端的安全传输路径之后所述终端的安全传输路径；所述源安全终结点为所述源安全传输路径的安全终结点；所述目标安全终结点为所述目标安全传输路径的安全终结点，所述源安全终结点和所述目标安全终结点中一个为所述接入网节点，另一个为所述用户面网关。
在一种可能的实现方式中，所述第一消息还包括第一会话的标识，所述第一消息具体用于指示切换所述终端的所述第一会话的安全传输路径。
在一种可能的实现方式中，所述第一消息还包括所述第一会话的第一业务流的标识，所述第一消息具体用于指示切换所述第一业务流的安全传输路径。
在一种可能的实现方式中，所述第二网元为所述接入网节点，所述第一指示信息至少用于指示所述目标安全终结点，所述目标安全终结点为所述用户面网关，所述第一消息还包括所述用户面网关的上行TEID。
在一种可能的实现方式中，所述处理单元，还用于根据网络负载、网络运行和部署情况、本地策略、第三方策略、运营商策略、大数据分析结果中的一个或多个确定切换所述终端的安全传输路径；或者，所述通信单元，还用于接收第二指示信息并根据所述第二指示信息确定切换所述终端的安全传输路径，所述第二指示信息用于指示切换所述终端的安全传输路径。
第六方面，提供了一种切换传输路径的装置，包括：通信单元和处理单元；所述通信单元，用于从第一网元接收第一消息，所述第一消息用于指示切换终端的安全传输路径，所述终端的安全传输路径包括第一安全传输路径和第二安全传输路径，所述第一安全传输路径是安全终结点为接入网节点和所述终端的用户面传输路径，所述第二安全传输路径是安全终结点为用户面网关和所述终端的用户面传输路径，所述安全终结点为对所述终端的用户面数据进行安全保护的节点；其中，所述第一网元为移动性管理网元，所述切换传输路径的装置为所述接入网节点；或者，所述第一网元为会话管理网元，所述切换传输路径的装置为所述用户面网关；在目标安全传输路径的安全终结点包括所述切换传输路径的装置的情况下，所述处理单元，用于根据所述第一消息获取所述终端的至少一个会话的安全上下文，并采用所述至少一个会话的安全上下文对所述至少一个会话进行安全保护；其中，所述至少一个会话为从源安全传输路径切换到所述目标安全传输路径的会话，所述源安全传输路径为切换所述终端的安全传输路径之前所述终端的安全传输路径；所述目标安全传输路径为切换所述终端的安全传输路径之后所述终端的安全传输路径。
在一种可能的实现方式中，在所述目标安全传输路径的安全终结点不包括所述切换传输路径的装置的情况下，所述处理单元，还用于根据所述第一消息删除所述至少一个会话的安全上下文。
在一种可能的实现方式中，所述第一消息包括第一指示信息；所述第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，所述第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，所述源安全终结点为所述源安全传输路径的安全终结点；所述目标安全终结点为所述目标安全传输路径的安全终结点，所述源安全终结点和所述目标安全终结点中一个为所述接入网节点，另一个为所述用户面网 关；在所述第一指示信息用于指示所述源安全传输路径的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述源安全传输路径；或者，在所述第一指示信息用于指示所述目标安全传输路径的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述目标安全传输路径；或者，在所述第一指示信息用于指示所述源安全传输路径和所述目标安全传输路径的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述源安全传输路径和所述目标安全传输路径；或者，在所述第一指示信息用于指示所述源安全终结点的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述源安全终结点；或者，在所述第一指示信息用于指示所述目标安全终结点的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述目标安全终结点；或者，在所述第一指示信息用于指示所述源安全终结点和所述目标安全终结点的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述源安全终结点和所述目标安全终结点。
在一种可能的实现方式中，所述第一消息还包括第一会话的标识，所述第一消息具体用于指示切换所述终端的所述第一会话的安全传输路径，所述至少一个会话为所述第一会话。
在一种可能的实现方式中，所述第一消息还包括所述第一会话的第一业务流的标识，所述第一消息具体用于指示切换所述终端的所述第一会话的所述第一业务流的安全传输路径；所述处理单元，具体用于：根据所述第一消息获取所述第一会话的所述第一业务流的安全上下文。
在一种可能的实现方式中，所述第一消息还包括所述第一会话的第一业务流的标识，所述第一消息具体用于指示切换所述终端的所述第一会话的所述第一业务流的安全传输路径，在所述目标安全传输路径的安全终结点不包括所述切换传输路径的装置的情况下；所述处理单元，具体用于：根据所述第一消息删除所述第一会话的所述第一业务流的安全上下文。
在一种可能的实现方式中，所述切换传输路径的装置为所述接入网节点，所述第一指示信息至少用于指示所述目标安全终结点，所述目标安全终结点为所述用户面网关，所述第一消息还包括所述用户面网关的上行TEID，所述处理单元，还用于采用所述通信单元通过所述上行TEID指示的隧道向所述用户面网关发送属于所述至少一个会话的数据，所述至少一个会话采用所述至少一个会话的安全上下文进行安全保护。
在一种可能的实现方式中，所述切换传输路径的装置为所述接入网节点；所述处理单元，还用于根据所述第一消息通过所述通信单元向所述终端发送第二消息，所述第二消息用于指示切换所述终端的安全传输路径。
在一种可能的实现方式中，在所述第一消息包括所述第一指示信息的情况下，所述第二消息包括所述第一指示信息。
在一种可能的实现方式中，在所述第一消息还包括所述第一会话的标识的情况下，所述第二消息还包括所述第一会话的标识，所述第二消息具体用于指示切换所述终端的所述第一会话的安全传输路径。
在一种可能的实现方式中，在所述第一消息还包括所述第一会话的第一业务流的 标识的情况下，所述第二消息还包括所述第一会话的第一业务流的标识，所述第二消息具体用于指示切换所述第一业务流的安全传输路径。
第七方面，提供了一种切换传输路径的装置，该切换传输路径的装置包括：存储器和处理器；可选的，还包括至少一个通信接口和通信总线；存储器用于存储计算机执行指令，处理器、存储器和至少一个通信接口通过通信总线连接，处理器执行存储器存储的计算机执行指令，以使切换传输路径的装置实现第一方面至第三方面中的任一方面提供的任意一种方法。该装置可以以芯片的产品形态存在。
第八方面，提供了一种通信系统，包括：第四方面、第五方面和第六方面提供的切换传输路径的装置。
第九方面，提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行第一方面至第三方面中的任一方面提供的任意一种方法。
第十方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行第一方面至第三方面中的任一方面提供的任意一种方法。
第四方面至第十方面中的任一种设计方式所带来的技术效果可参见第一方面至第三方面中对应设计方式所带来的技术效果，此处不再赘述。
其中，需要说明的是，上述各个方面中的任意一个方面的各种可能的实现方式，在方案不矛盾的前提下，均可以进行组合。
附图说明
图1为一种网络架构的组成示意图；
图2为本申请实施例提供的一种安全传输路径的示意图；
图3为本申请实施例提供的一种切换传输路径的方法的流程图；
图4为本申请实施例提供的又一种切换传输路径的方法的流程图；
图5为本申请实施例提供的又一种切换传输路径的方法的流程图；
图6为本申请实施例提供的又一种切换传输路径的方法的流程图；
图7为本申请实施例提供的再一种切换传输路径的方法的流程图；
图8为本申请实施例提供的一种切换传输路径的装置的组成示意图；
图9为本申请实施例提供的一种切换传输路径的装置的硬件结构示意图；
图10为本申请实施例提供的一种终端和接入网节点的硬件结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。其中，在本申请的描述中，除非另有说明，“/”表示或的意思，例如，A/B可以表示A或B。本文中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。“至少一个”是指一个或多个。
另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
本申请实施例的技术方案可以应用于各种通信系统。例如：正交频分多址(orthogonal frequency-division multiple access，简称OFDMA)、单载波频分多址(single carrier FDMA，简称SC-FDMA)和其它系统等。术语“系统”可以和“网络”相互替换。其中，OFDMA系统可以实现诸如演进通用无线陆地接入(evolved universal terrestrial radio access，简称E-UTRA)、超级移动宽带(ultra mobile broadband，简称UMB)等无线技术。E-UTRA是通用移动通信系统(universal mobile telecommunications system，简称UMTS)演进版本。第三代合作伙伴计划(3rd generation partnership project，简称3GPP)在长期演进(long term evolution，简称LTE)和基于LTE演进的各种版本是使用E-UTRA的新版本。第五代(5th-generation，简称5G)通信系统、新空口(new radio，简称NR)通信系统是正在研究当中的下一代通信系统。此外，通信系统还可以适用于面向未来的通信技术，都适用本申请实施例提供的技术方案。
示例性的，本申请实施例提供的方法可以应用于图1所示的5G通信系统。如图1所示，该5G通信系统可以包括下述网络功能(network functions，简称NF)实体中的一个或多个：鉴权服务器功能(authentication server function，简称AUSF)实体、接入和移动管理功能(access and mobility management function，简称AMF)实体、会话管理功能(session management function，简称SMF)实体、(无线)接入网((radio)access network，简称(R)AN)设备、UPF实体、数据网络(data network，简称DN)、终端、应用功能(application function，简称AF)实体、统一数据管理(unified data management，简称UDM)实体、策略控制功能(policy control function，简称PCF)实体、网络开放功能(network exposure function，简称NEF)实体，网络功能库功能(network repository function，简称NRF)实体。
RAN设备是指RAN中的设备。基于无线通信技术实现接入网络功能的接入网可以称为RAN。RAN能够管理无线资源，为终端提供接入服务，进而完成控制信号和用户数据在终端和核心网之间的转发。RAN可以采用3GPP接入技术(例如，3G、4G或5G通信系统中采用的无线接入技术)和非3GPP(non-3GPP)接入技术。RAN为特定区域的授权用户提供入网功能，并能够根据用户的级别，业务的需求等使用不同质量的传输隧道。非3GPP接入技术是指不符合3GPP标准规范的接入技术，例如，以无线保真(wireless-fidelity，简称WIFI)中的接入点(access point，简称AP)为代表的空口技术。
RAN设备主要负责空口侧的无线资源管理、服务质量(quality of service，简称QoS)管理、数据压缩和加密等功能。RAN设备可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，AP等。在5G通信系统中，基站称为下一代基站节点(next generation node base station，简称gNB)。5G通信系统中的RAN设备也可以称为NG-RAN设备或NG-RAN节点。
AMF实体属于核心网实体，主要负责移动性管理处理部分，例如：接入控制、移动性管理、附着与去附着以及SMF实体选择等功能。AMF实体为终端中的会话提供服务的情况下，会为该会话提供控制面的存储资源，以存储会话标识、与会话标识关联的SMF实体标识等。
SMF实体主要用于会话管理、终端的互联网协议(internet protocol，简称IP)地址分配和管理、选择可管理用户平面功能、策略控制、或收费功能接口的终结点以及下行数据通知等。
UPF实体可用于分组路由和转发、或用户面数据的QoS处理等。用户数据可通过该网元接入到DN。
DN是用于提供传输数据的网络。例如，运营商业务的网络、因特(Internet)网、第三方的业务网络等。
本申请实施例涉及到的网元包括移动性管理网元、会话管理网元、用户面网关、接入网节点和终端。
其中，接入网节点可以是各种形式的宏基站，微基站(也称为小站)，中继站，AP等，也可以包括各种形式的控制节点，如网络控制器。所述控制节点可以连接多个基站，并为所述多个基站覆盖下的多个终端配置资源。在采用不同的无线接入技术的系统中，具备基站功能的设备的名称可能会有所不同，例如，全球移动通信系统(global system for mobile communication，简称GSM)或码分多址(code division multiple access，简称CDMA)网络中可以称为基站收发信台(base transceiver station，简称BTS)，宽带码分多址(wideband code division multiple access，简称WCDMA)中可以称为基站(NodeB)，LTE系统中可以称为演进型基站(evolved NodeB，简称eNB或eNodeB)，5G通信系统或NR通信系统中可以称为gNB，本申请对基站的具体名称不作限定。接入网节点还可以是云无线接入网络(cloud radio access network，简称CRAN)场景下的无线控制器、未来演进的公共陆地移动网络(public land mobile network，简称PLMN)网络中的接入网节点、传输接收节点(transmission and reception point，简称TRP)等。
终端也可以称为用户设备(user equipment，简称UE)、终端设备、接入终端、用户单元、用户站、移动站、远方站、远程终端、移动设备、用户终端、无线通信设备、用户代理或用户装置等。终端可以是无人机、物联网(internet of things，简称IoT)设备(例如，传感器，电表，水表等)、车联网(vehicle-to-everything，简称V2X)设备、无线局域网(wireless local area networks，简称WLAN)中的站点(station，简称ST)、蜂窝电话、无绳电话、会话启动协议(session initiation protocol，简称SIP)电话、无线本地环路(wireless local loop，简称WLL)站、个人数字处理(personal digital assistant，简称PDA)设备、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备(也可以称为穿戴式智能设备)。终端还可以为下一代通信系统中的终端，例如，5G通信系统中的终端或者未来演进的PLMN中的终端，NR通信系统中的终端等。
用户面网关可以为各个通信系统中的用户面网关，例如，UPF实体，也可以为网关代理(proxy)，例如，UPF的代理(proxy)、以及可能具有用户面网关功能的NEF等。其中，用户面网关功能包括分组路由和转发用户面数据，对用户面数据进行QoS处理等。
为了描述方便，本申请实施例中以提供的方法应用于NR通信系统或5G通信系统中为例进行说明。其中，移动性管理网元在下文中记为AMF(即下文中的AMF均可以 替换为移动性管理网元)，会话管理网元在下文中记为SMF(即下文中的SMF均可以替换为会话管理网元)，接入网节点在下文中记为RAN节点(即下文中的RAN节点均可以替换为接入网节点)，用户面网关在下文中记为UPF(即下文中的UPF均可以替换为用户面网关)。本申请实施例中涉及到的网元均为NR通信系统或5G通信系统中的网元，可以理解的是，当本申请实施例提供的方法应用于其他通信系统(例如，4G通信系统，未来的通信系统)中时，将5G通信系统中的网元替换为该其他通信系统中的具有相同或相似功能的网元即可。例如，当本申请实施例提供的方法应用于4G通信系统中时，下文中的AMF可以替换为MME。
为了使得本申请实施例更加的清楚，以下对本申请实施例中涉及到的部分概念作简单介绍。
1、小数据(small data)
小数据是指数据量较小的数据。例如，DN与测距仪、水表、电表、传感器等物联网设备之间传输的数据。小数据传输主要应用于蜂窝物联网(cellular internet of things，简称CIoT)中，可以用于低复杂性、能量受限且低传输速率的终端。在某些场景中，这些终端可能是低移动性的，例如，水表、电表等。
2、安全上下文
安全上下文是指可以用于实现数据的安全保护(例如，加解密和/或完整性保护)的信息。
安全上下文可以包括：加密密钥/解密密钥、完整性保护密钥、新鲜参数(比如NAS Count，其中，NAS是指非接入层(Non-access stratum))、密钥集标识(key set identifier，简称KSI)、安全算法、安全相关指示(例如，是否开启加密的指示，是否开启完整性保护的指示、密钥使用期限的指示，密钥长度)等。
其中，加密密钥为发送端根据加密算法对明文进行加密以生成密文时输入的参数。若使用对称加密的方法，加密密钥和解密密钥是相同的。接收端可以根据相同的加密算法和加密密钥对密文进行解密。换句话说，发送端和接收端可以基于同一个密钥去加密和解密。
完整性保护密钥为发送端根据完整性保护算法对明文或密文进行完整性保护时输入的参数。接收端可以根据相同的完整性保护算法和完整性保护密钥对进行了完整性保护的数据进行完整性验证。
安全算法即对数据进行安全保护时使用的算法。例如，加密算法、解密算法、完整性保护算法等。
3、安全终结点(termination point)
安全终结点为对终端的用户面数据进行安全保护的节点。安全终结点负责数据的加解密和/或完整性保护。
4、会话
本申请实施例中的会话是指终端和服务网络之间的一种数据连接。会话在5G通信网络中可以称为协议数据单元(protocol data unit，简称PDU)会话，在4G通信网络中可以称为承载。在未来的通信网络中可能会有其他的名称，本申请实施例对此不作限制。会话可以包括多个业务流，业务流在5G通信网络中可以为Qos流(flow)。
5、安全传输路径
安全传输路径是指两个安全终结点之间的传输路径。其中，一个安全终结点负责数据的加密和完整性保护，另一个安全终结点负责数据的解密和完整性验证。
参见图2，这两个安全终结点可以为终端和RAN节点，此时，用户面安全建立在终端和RAN节点之间。该情况下，安全传输路径可以称为：UE-RAN安全传输路径。此时，安全终结点采用的安全上下文可以称为：UE-RAN安全上下文。
参见图2，这两个安全终结点也可以为终端和UPF，此时，用户面安全建立在终端和UPF之间。该情况下，安全传输路径可以称为：UE-UPF安全传输路径。此时，安全终结点采用的安全上下文可以称为：UE-UPF安全上下文。
示例性的，UE-UPF安全传输路径可以为小数据快速通道(smalldata fast path，简称SDFP)，SDFP用于优化上下文管理空闲态(context management IDLE，简称CM-IDLE)状态下CIOT终端的小数据传输。具体的说，是建立快速通道，使得小数据可以快速的在终端→RAN节点→UPF专用通道上通过N3和N6接口传输。SDFP可以在CM-IDLE和上下文管理连接态(context managementCONNECTED，简称CM-CONNECTED)的状态转换过程中建立，CM-CONNECTED是指终端处于连接时的状态或传输数据的状态，CM-IDLE和CM-CONNECTED的状态转换过程中不需要或者需要极少的信令交互。
其中，通过UE-RAN安全传输路径传输数据的数据传输方式和通过UE-UPF安全传输路径传输数据的数据传输方式可以认为是两种不同的安全传输方式，该情况下，下文中的切换安全传输路径也可以认为是切换安全传输方式。
6、源安全传输路径、目标安全传输路径、源安全终结点、目标安全终结点
本申请实施例中涉及到切换终端的安全传输路径的场景，因此，本申请实施例中定义了源安全传输路径、目标安全传输路径、源安全终结点和目标安全终结点的概念。其中，源安全传输路径为切换终端的安全传输路径之前终端的安全传输路径。目标安全传输路径为切换终端的安全传输路径之后终端的安全传输路径。源安全终结点为源安全传输路径的安全终结点。目标安全终结点为目标安全传输路径的安全终结点。本申请实施例中的源安全终结点和目标安全终结点中一个为RAN节点，另一个为UPF。例如，源安全终结点为RAN节点，目标安全终结点为UPF；或者，源安全终结点为UPF，目标安全终结点为RAN节点。
需要说明的是，本申请实施例中的终端支持通过不同的安全传输路径传输数据。针对UE-RAN安全传输路径和UE-UPF安全传输路径，当终端采用其中一种安全传输路径传输数据时，若另一种安全传输路径更优，或者，安全终结点需要切换时，终端需要切换终端的安全传输路径，相应的，还需要切换终端的安全上下文，以便各个网元使用正确的安全上下文传输数据。为此，本申请实施例提供了一种切换传输路径的方法，可以应用于需要切换安全传输路径的场景中。
本申请实施例描述的系统架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定。本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
需要指出的是，本申请各实施例中涉及的名词或术语可以相互参考，不予限制。
本申请实施例提供了一种切换传输路径的方法，包括：
301、第一网元确定切换终端的安全传输路径。
其中，第一网元为AMF或SMF。
终端的安全传输路径包括第一安全传输路径和第二安全传输路径。第一安全传输路径是安全终结点为RAN节点和终端的用户面传输路径，即UE-RAN安全传输路径。第二安全传输路径是安全终结点为UPF和终端的用户面传输路径，即UE-UPF安全传输路径。
302、第一网元向第二网元发送第一消息，第一消息用于指示切换终端的安全传输路径。相应的，第二网元从第一网元接收第一消息。
其中，在第一网元为AMF的情况下，第二网元为RAN节点。在第一网元为SMF的情况下，第二网元为UPF。
第一网元为AMF时，第一消息记为第一消息A，第一消息A可以为下一代应用协议(next generation application protocol，简称NGAP)消息，N2消息等。第一网元为SMF时，第一消息记为第一消息B。第一消息B可以为N4消息，例如，N4会话建立请求(N4 Session Establishment Request)，N4会话修改请求(N4 Session Modification Request)等。由于第一消息A和第一消息B是在不同的网元之间传输的消息，由此可知，第一消息A和第一消息B必然为不同的消息。
第一消息也可以称为切换请求、安全终结点切换请求、安全传输路径切换请求等，第一消息可以理解为通知安全传输路径切换的消息，消息名根据具体的业务场景可以不同。
在目标安全传输路径的安全终结点包括第二网元的情况下，步骤302之后可以执行步骤303。在目标安全传输路径的安全终结点不包括第二网元的情况下，步骤302之后可以执行步骤304(步骤304为可选步骤)。
303、第二网元根据第一消息获取终端的至少一个会话的安全上下文，并采用至少一个会话的安全上下文对至少一个会话进行安全保护。
其中，至少一个会话为从源安全传输路径切换到目标安全传输路径的会话。终端的至少一个会话可以为终端的全部会话，也可以为终端的部分会话。
在第二网元为RAN节点的情况下，RAN节点可以从存储的安全上下文中去查找得到至少一个会话的安全上下文，也可以自行生成至少一个会话的安全上下文。
在第二网元为UPF的情况下，UPF可以从SMF获取至少一个会话的安全上下文，也可以自行生成至少一个会话的安全上下文。
在步骤303之后，第二网元可以对终端的至少一个会话进行重配置。进一步的，在对终端的至少一个会话进行重配置之后，第二网元可以立即激活至少一个会话的完整性保护和/或加密，也可以在进行数据传输时激活至少一个会话的完整性保护和/或加密。
304、第二网元根据第一消息删除至少一个会话的安全上下文。
步骤304的执行可以起到节约第二网元的存储空间的效果。当然，第二网元也可以不删除至少一个会话的安全上下文，以便后续至少一个会话的恢复。
本申请实施例提供的方法，可以实现终端的第一安全传输路径和第二安全传输路 径之间的切换，从而在不同的场景中，选择是否切换终端的安全传输路径，使得数据的安全保护灵活的适应不断变化的网络场景。
可选的，步骤301在具体实现时可以通过以下方式一或方式二中的任意一种方式实现。
方式一、
第一网元根据网络负载、网络运行和部署情况、本地策略、第三方策略、运营商策略、大数据分析结果中的一个或多个确定切换终端的安全传输路径。
在第一网元根据网络负载确定切换终端的安全传输路径的情况下，一种可能的实现方式，第一网元可以在RAN节点的负载较高(例如，大于等于80％)时，确定将UE-RAN安全传输路径切换至UE-UPF安全传输路径。另一种可能的实现方式，第一网元可以在RAN节点的负载恢复正常(例如，小于等于60％)时，确定将UE-UPF安全传输路径切换至UE-RAN安全传输路径。
在第一网元根据网络运行和部署情况确定切换终端的安全传输路径的情况下，一种可能的实现方式，若发生了UPF重选(也可以称为切换)事件或其他移动性事件，当SMF选择的UPF不支持UE-UPF安全传输路径时，第一网元确定将UE-UPF安全传输路径切换至UE-RAN安全传输路径，此处的UE-UPF安全传输路径的安全终结点包括UPF重选之前的UPF。另一种可能的实现方式，若发生了UPF重选事件，当SMF选择的UPF支持UE-UPF安全传输路径时，第一网元确定将UE-RAN安全传输路径切换至UE-UPF安全传输路径，此处的UE-UPF安全传输路径的安全终结点包括UPF重选之后的UPF。
第一网元还可以根据本地策略、第三方策略、运营商策略等确定切换终端的安全传输路径。此处的本地策略、第三方策略、运营商策略可以分别为本地的、第三方发送的、运营商配置的确定切换终端的安全传输路径的规则，该规则可以根据实际的应用场景确定，此处不再一一展开描述。其中，本地策略可以为区域运营商或第三方配置在第一网元上的策略。第一网元还可以根据大数据分析结果确定切换终端的安全传输路径，例如，若大数据分析结果显示UE-RAN安全传输路径的数据传输效率优于UE-UPF安全传输路径，则第一网元可以确定将UE-UPF安全传输路径切换至UE-RAN安全传输路径。
另外，第一网元还可以根据网络负载、网络运行和部署情况、本地策略、第三方策略、运营商策略、大数据分析结果中的多个确定切换终端的安全传输路径。例如，第一网元根据网络负载以及网络运行和部署情况确定切换终端的安全传输路径。该情况下，若发生了UPF重选事件，当SMF选择的UPF支持UE-UPF安全传输路径、且RAN节点的负载较高(例如，大于等于80％)时，第一网元确定将UE-RAN安全传输路径切换至UE-UPF安全传输路径，此处的UE-UPF安全传输路径的安全终结点包括UPF重选之后的UPF。
方式二、
第一网元接收第二指示信息，并根据第二指示信息确定切换终端的安全传输路径，第二指示信息用于指示切换终端的安全传输路径。
在方式二下，确定切换终端的安全传输路径的网元可以为PCF、NEF、AF或其他可以提供用户数据传输策略信息的网元中的一个或多个。PCF、NEF、AF或其他可以提供 用户数据传输策略信息的网元可以采用类似于方式一中第一网元确定切换终端的安全传输路径的方法确定切换终端的安全传输路径。该情况下，第一网元可以从PCF、NEF、AF或其他可以提供用户数据传输策略信息的网元接收第二指示信息。
在第一网元为AMF的情况下，第一网元还可以从SMF接收第二指示信息，SMF可以采用方式一确定切换终端的安全传输路径，或者，根据PCF、NEF、AF或其他可以提供用户数据传输策略信息的网元发送的第二指示信息确定切换终端的安全传输路径。
在第一网元为SMF的情况下，第一网元还可以从AMF接收第二指示信息，AMF可以采用方式一确定切换终端的安全传输路径，或者，根据PCF、NEF、AF或其他可以提供用户数据传输策略信息的网元发送的第二指示信息确定切换终端的安全传输路径。
本申请实施例中通过图3至图6对上述实施例中的实现流程作示例性说明。在图3至图6中，第一网元为AMF时，上述步骤301至步骤304记为步骤301a至步骤304a。第一网元为SMF时，上述步骤301至步骤304记为步骤301b至步骤304b。其中，在图3和图5中，终端的安全传输路径从UE-UPF安全传输路径切换至UE-RAN安全传输路径，在图4和图6中，终端的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径。在图3和图4中，上述方法还包括：300a、SMF向AMF发送第二指示信息，该情况下，步骤301a具体包括：AMF根据第二指示信息确定切换终端的安全传输路径。在图5和图6中，上述方法还包括：300b、AMF向SMF发送第二指示信息，该情况下，步骤301b具体包括：SMF根据第二指示信息确定切换终端的安全传输路径。
可选的，第一消息包括第一指示信息；第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，第一指示信息用于指示源安全终结点和/或目标安全终结点。该情况下，上述方法还包括：
在第一指示信息用于指示源安全传输路径的情况下，第二网元根据第一消息中的第一指示信息确定源安全传输路径；或者，
在第一指示信息用于指示目标安全传输路径的情况下，第二网元根据第一消息中的第一指示信息确定目标安全传输路径；或者，
在第一指示信息用于指示源安全传输路径和目标安全传输路径的情况下，第二网元根据第一消息中的第一指示信息确定源安全传输路径和目标安全传输路径；或者，
在第一指示信息用于指示源安全终结点的情况下，第二网元根据第一消息中的第一指示信息确定源安全终结点；或者，
在第一指示信息用于指示目标安全终结点的情况下，第二网元根据第一消息中的第一指示信息确定目标安全终结点；或者，
在第一指示信息用于指示源安全终结点和目标安全终结点的情况下，第二网元根据第一消息中的第一指示信息确定源安全终结点和目标安全终结点。
其中，在第一指示信息用于指示源安全传输路径或目标安全传输路径的情况下，第一指示信息可以通过一个或多个比特(bit)位指示，该一个或多个比特位的值代表了源安全传输路径或目标安全传输路径是UE-UPF安全传输路径还是UE-RAN安全传输路径。例如，一个比特位的值为0时，表示源安全传输路径为UE-UPF安全传输路径，则目标安全传输路径自然为UE-RAN安全传输路径；该比特位的值为1时，表示源安全传输路径为UE-RAN安全传输路径，则目标安全传输路径自然为UE-UPF安全传输路径。
第一指示信息也可以通过字符串指示，例如，当字符串为“Normal”时，表示源安全传输路径或目标安全传输路径为UE-RAN安全传输路径，当字符串为“Small data”或“SDFP”时，表示源安全传输路径或目标安全传输路径为UE-UPF安全传输路径。
在第一指示信息用于指示源安全传输路径和目标安全传输路径的情况下，第一指示信息可以通过多个比特位指示。其中，一个比特位用于指示源安全传输路径，另一个比特位用于指示目标安全传输路径。
在第一指示信息用于指示源安全终结点和/或目标安全终结点的情况下，第一指示信息可以为源安全终结点的标识和/或目标安全终结点的标识。源安全终结点和目标安全终结点中一个为RAN节点，另一个为UPF。其中，RAN节点的标识可以为小区的标识、基站的标识、基站的集中式单元(centralized unit，简称CU)的标识、基站的分布式单元(distributed unit，简称DU)的标识、基站的频点的标识、基站的控制面的标识、基站的用户面的标识。UPF的标识(identity)可以为UPF的索引值(index)，UPF的计数值(Counter)(表明第几个UPF)、UPF的IP地址、UPF对应的隧道ID等。
需要说明的是，在UPF重选的场景下，在UPF重选完成之前，源安全终结点可以为UPF重选完成之前的UPF。在UPF重选的场景下，源安全终结点也可以为RAN节点，该情况下，在UPF重选完成之前，目标安全终结点可以为SMF或重选之前的UPF重新为终端选择的服务UPF(即UPF重选需要重选到的UPF)，在UPF重选完成之后，目标安全终结点可以为UPF重选完成后的UPF。
可选的，第一消息还包括第一会话的标识，第一消息具体用于指示切换终端的第一会话的安全传输路径。该情况下，上述至少一个会话为第一会话。
该情况下，第一网元可以进一步确定切换的为终端的第一会话的安全传输路径。该情况下，上述第二指示信息具体用于指示切换终端的第一会话的安全传输路径。进一步的，第二指示信息还可以用于指示源安全传输路径和目标安全传输路径。
其中，第一会话可以包括一个或多个会话。会话的标识可以为PDU会话的ID(PDU session ID)，会话对应的业务ID，会话对应的业务的业务类型等。
一个会话可以包括一个或多个业务流，在第二网元中，一个会话可以对应一个安全上下文。该情况下，以会话为PDU会话，业务流为Qos流为例，参见表1，若第一会话为PDU会话1，则第二网元可以获取安全上下文1，并采用安全上下文1对PDU会话1进行安全保护。若第一会话为PDU会话2和PDU会话3，则第二网元可以获取安全上下文2和安全上下文3，并采用安全上下文2和安全上下文3分别对PDU会话2和PDU会话3进行安全保护。
表1
Figure PCTCN2019070714-appb-000001
可选的(记为可选方法1)，第一消息还包括第一会话的第一业务流的标识，第一消息具体用于指示切换第一业务流的安全传输路径。该情况下，步骤303在具体实现时，可以包括：第二网元根据第一消息获取第一会话的第一业务流的安全上下文。步骤304在具体实现时，可以包括：第二网元根据第一消息删除第一会话的第一业务流的安全上下文。
该情况下，在步骤303之后，第二网元可以对终端的第一会话的第一业务流进行重配置。进一步的，在对终端的第一会话的第一业务流进行重配置之后，第二网元可以立即激活第一会话的第一业务流的完整性保护和/或加密，也可以在进行数据传输时激活第一会话的第一业务流的完整性保护和/或加密。
在可选方法1中，第一网元可以进一步确定切换的为终端的第一会话的第一业务流的安全传输路径。该情况下，上述第二指示信息具体用于指示切换终端的第一会话的第一业务流的安全传输路径。进一步的，第二指示信息还可以用于指示源安全传输路径和目标安全传输路径。
其中，第一业务流可以包括一个或多个业务流。业务流的标识可以包括但不限于以下信息中的一个或多个：QoS流标识(QoS flow identifier，简称QFI)、5G Qos标识(5G QoS identifier，简称5QI)、QoS标识(Identifier)。
在第二网元中，一个会话的所有业务流可以对应一个安全上下文。该情况下，以会话为PDU会话，业务流为Qos流为例，参见表1，若第一会话为PDU会话1，第一会话的第一业务流为PDU会话1的Qos流1，则第二网元可以获取安全上下文1，并采用安全上下文1对PDU会话1的Qos流1进行安全保护。若第一会话为PDU会话2和PDU会话3，第一会话的第一业务流为PDU会话2的Qos流2和PDU会话3的Qos流1，则第二网元可以获取安全上下文2和安全上下文3，并采用安全上下文2和安全上下文3分别对PDU会话2的Qos流2和PDU会话3的Qos流1进行安全保护。
在第二网元中，一个会话的多个业务流也可以各自对应一个安全上下文。该情况下，以会话为PDU会话，业务流为Qos流为例，参见表2，若第一会话为PDU会话1，第一会话的第一业务流为PDU会话1的Qos流1，则第二网元可以获取安全上下文1，并采用安全上下文1对PDU会话1的Qos流1进行安全保护。若第一会话为PDU会话2和PDU会话3，第一会话的第一业务流为PDU会话2的Qos流2和PDU会话3的Qos流1，则第二网元可以获取安全上下文4和安全上下文5，并采用安全上下文4和安全上下文5分别对PDU会话2的Qos流2和PDU会话3的Qos流1进行安全保护。
表2
Figure PCTCN2019070714-appb-000002
可选的，第一消息还包括终端的标识，以便第二网元确定切换安全传输路径的终端。终端的标识可以为：IP地址、永久设备标识(permanentequipment identifier， 简称PEI)、用户永久标识(subscription permanent identifier，简称SUPI)、用户隐藏标识(subscription concealed identifier，简称SUCI)、临时移动客户识别码(temporary mobile subscriber identifier，简称TMSI)、IP多媒体公共标识(IP multimedia public identity，简称IMPU)、媒体访问控制(media access control，简称MAC)地址、手机号码和全局唯一的临时标识(globally unique temporary UE identity，简称GUTI)中的至少一项，在此不作限制。其中，4G通信系统中的GUTI一般直接称为GUTI，5G通信系统中的GUTI一般称为5G GUTI。PEI为终端的固定标识。SUPI为用户的永久标识。SUCI为对SUPI进行加密后的用户标识。
在上述实施例中，需要说明的是，在一种可能的实现方式中，第一网元为SMF，第二网元为UPF，DN或RAN节点可以确定切换终端的安全传输路径，该情况下，UPF接收到的指示切换终端的安全传输路径的信息可以不是SMF发送的，而是DN或RAN节点发送的。此时，指示切换终端的安全传输路径的信息可以携带在终端的上行数据包或下行数据包中。在另一种可能的实现方式，UPF接收到的第一消息可以不是SMF发送的，而是由AMF发送的。
可选的，第一网元为AMF，第二网元为RAN节点，第一指示信息至少用于指示目标安全终结点，目标安全终结点为UPF，第一消息A还包括UPF的上行隧道端点标识(tunnel endpoint identifier，简称TEID)。该情况下，上述方法还包括：第二网元通过上行TEID指示的隧道向UPF发送属于上述至少一个会话或上述第一会话或上述第一会话的第一业务流的数据，上述至少一个会话、上述第一会话和上述第一会话的第一业务流分别采用上述至少一个会话、上述第一会话和上述第一会话的第一业务流对应的目标安全上下文进行安全保护。
第二网元通过上行TEID指示的隧道向UPF发送的具体是属于哪个/哪些会话或业务流的数据取决于上述实施例中的第一网元确定的切换安全传输路径的会话或业务流。
需要说明的是，在UPF重选场景下，当目标安全终结点为UPF重选完成后的UPF时，RAN节点不知道通过哪条隧道向新的UPF(即UPF重选完成后的UPF)发送数据，该情况下，第一消息A中还可以包括UPF的上行TEID，以便RAN节点向该新的UPF发送数据。
在第一网元为AMF，第二网元为RAN节点的情况下，上述方法还可以包括以下可选方法2至可选方法5。
可选的(记为可选方法2)，上述方法还包括：
305、RAN节点根据第一消息A向终端发送第二消息，第二消息用于指示切换终端的安全传输路径。相应的，终端从RAN节点接收第二消息。
306、终端根据第二消息将终端的至少一个会话的安全上下文从源安全上下文切换至目标安全上下文。
其中，一个会话的源安全上下文为属于该会话的数据在源安全传输路径上传输时终端所使用的安全上下文，一个会话的目标安全上下文为属于该会话的数据在目标安全传输路径上传输时终端所使用的安全上下文。
307、终端根据至少一个会话的目标安全上下文在目标安全传输路径上传输属于至少一个会话的数据。
其中，第二消息可以为一个RRC消息或其他可以传递该第二消息中的信息的空口或非接入层消息。例如，第二消息可以为RRC重配置消息，安全激活消息等。第二消息也可以称为切换请求、安全终结点切换请求、安全传输路径切换请求等，第二消息可以理解为通知安全传输路径切换的消息，消息名根据具体的业务场景可以不同。
步骤306在具体实现时，终端可以从存储的安全上下文中去查找得到至少一个会话的目标安全上下文，也可以自行生成至少一个会话的目标安全上下文。在步骤306之后，终端可以对至少一个会话进行重配置。进一步的，终端在对至少一个会话进行重配置之后，终端可以立即激活至少一个会话的完整性保护和/或加密，也可以在用户面数据正式传输时激活至少一个会话的完整性保护和/或加密，也可以在完成与网络的信令连接方面的通信后激活至少一个会话的完整性保护和/或加密。
在步骤306之后，该方法还可以包括：终端向RAN节点发送第二消息的响应，第二消息的响应用于指示终端完成了安全传输路径的安全上下文的配置。
步骤307在具体实现时，终端可以根据终端的至少一个会话的目标安全上下文对至少一个会话进行安全保护。
可选的(记为可选方法3)，在第一消息A包括第一指示信息的情况下，第二消息包括第一指示信息。该情况下，上述方法还包括：
在第一指示信息用于指示源安全传输路径的情况下，终端根据第二消息中的第一指示信息确定源安全传输路径；或者，
在第一指示信息用于指示目标安全传输路径的情况下，终端根据第二消息中的第一指示信息确定目标安全传输路径；或者，
在第一指示信息用于指示源安全传输路径和目标安全传输路径的情况下，终端根据第二消息中的第一指示信息确定源安全传输路径和目标安全传输路径；或者，
在第一指示信息用于指示源安全终结点的情况下，终端根据第二消息中的第一指示信息确定源安全终结点；或者，
在第一指示信息用于指示目标安全终结点的情况下，终端根据第二消息中的第一指示信息确定目标安全终结点；或者，
在第一指示信息用于指示源安全终结点和目标安全终结点的情况下，终端根据第二消息中的第一指示信息确定源安全终结点和目标安全终结点。
关于第一指示信息的指示方式，可参见上文中的相应部分，在此不再赘述。
可选的(记为可选方法4)，在第一消息A还包括第一会话的标识的情况下，第二消息还包括第一会话的标识，第二消息具体用于指示切换终端的第一会话的安全传输路径。该情况下，上述至少一个会话为第一会话。
关于会话的标识的相关描述可参见上文，在此不再赘述。
一个会话可以包括一个或多个业务流，在终端中，一个会话可以对应一个UE-RAN安全上下文和一个UE-UPF安全上下文。该情况下，以会话为PDU会话，业务流为Qos流，终端的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径为例，参见表3。若第一会话为PDU会话1，则终端可以将PDU会话1的安全上下文从UE-RAN安全上下文1切换至UE-UPF安全上下文1，并采用UE-UPF安全上下文1对PDU会话1进行安全保护。若第一会话为PDU会话2和PDU会话3，则终端可以将PDU会话2的 安全上下文从UE-RAN安全上下文2切换至UE-UPF安全上下文2，将PDU会话3的安全上下文从UE-RAN安全上下文3切换至UE-UPF安全上下文3,并采用UE-UPF安全上下文2和UE-UPF安全上下文3分别对PDU会话2和PDU会话3进行安全保护。
表3
Figure PCTCN2019070714-appb-000003
可选的(记为可选方法5)，在第一消息A还包括第一会话的第一业务流的标识的情况下，第二消息还包括第一会话的第一业务流的标识，第二消息具体用于指示切换第一业务流的安全传输路径。
该情况下，步骤306在具体实现时，可以包括：终端根据第二消息将第一会话的第一业务流的安全上下文从源安全上下文切换至目标安全上下文；一个业务流的源安全上下文为属于该业务流的数据在源安全传输路径上传输时终端所使用的安全上下文，一个业务流的目标安全上下文为属于该业务流的数据在目标安全传输路径上传输时终端所使用的安全上下文。步骤307在具体实现时，可以包括：终端根据第一会话的第一业务流的目标安全上下文在目标安全传输路径上传输属于第一会话的第一业务流的数据。
在步骤306之后，终端可以对第一会话的第一业务流进行重配置。进一步的，终端在对第一会话的第一业务流进行重配置之后，终端可以立即激活第一会话的第一业务流的完整性保护和/或加密，也可以在用户面数据正式传输时激活第一会话的第一业务流的完整性保护和/或加密，也可以在完成与网络的信令连接方面的通信后激活第一会话的第一业务流的完整性保护和/或加密。
在终端中，一个会话的所有业务流可以对应一个安全上下文。该情况下，以会话为PDU会话，业务流为Qos流，终端的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径为例，参见表3。若第一会话为PDU会话1，第一会话的第一业务流为PDU会话1的Qos流1，则终端可以将PDU会话1的Qos流1的安全上下文从UE-RAN安全上下文1切换至UE-UPF安全上下文1，并采用UE-UPF安全上下文1对PDU会话1的Qos流1进行安全保护。若第一会话为PDU会话2和PDU会话3，第一会话的第一业务流为PDU会话2的Qos流2和PDU会话3的Qos流1，则终端可以将PDU会话2的Qos流2的安全上下文从UE-RAN安全上下文2切换至UE-UPF安全上下文2，将PDU会话3的Qos流1的安全上下文从UE-RAN安全上下文3切换至UE-UPF安全上下文3,并采用UE-UPF安全上下文2和UE-UPF安全上下文3分别对PDU会话2的Qos流2和PDU会话3的Qos流1进行安全保护。
在终端中，一个会话的多个业务流也可以各自对应一个安全上下文。该情况下，以会话为PDU会话，业务流为Qos流，终端的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径为例，参见表4。若第一会话为PDU会话1，第一会话的第 一业务流为PDU会话1的Qos流1，则终端可以将PDU会话1的Qos流1的安全上下文从UE-RAN安全上下文1切换至UE-UPF安全上下文1，并采用UE-UPF安全上下文1对PDU会话1的Qos流1进行安全保护。若第一会话为PDU会话2和PDU会话3，第一会话的第一业务流为PDU会话2的Qos流2和PDU会话3的Qos流1，则终端可以将PDU会话2的Qos流2的安全上下文从UE-RAN安全上下文4切换至UE-UPF安全上下文4，将PDU会话3的Qos流1的安全上下文从UE-RAN安全上下文5切换至UE-UPF安全上下文5,并采用UE-UPF安全上下文4和UE-UPF安全上下文5分别对PDU会话2的Qos流2和PDU会话3的Qos流1进行安全保护。
表4
Figure PCTCN2019070714-appb-000004
经过上述实施例提供的方法，终端和RAN节点(或UPF)可以采用正确的安全上下文对属于会话的数据进行安全保护。
在本申请实施例提供的方法执行在UPF重选的场景中时，若终端切换安全传输路径是从UE-RAN安全传输路径切换至UE-UPF安全传输路径，则上述第二网元可以为UPF重选后的UPF，则UPF重选之前的UPF可以释放需要进行安全传输路径切换的会话。
需要说明的是，本申请实施例提供的方法也可以直接应用于业务流，该情况下，上述实施例中的“会话”可以替换为“业务流”，上述可选方法1和可选方法5不需要执行。
为了使得上述实施例更加的清楚，以下通过一个具体的示例对上述实施例的实现流程作示例性说明。该示例以UPF重选场景下将终端的第一会话的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径为例进行说明。参见图7，该流程包括：
701、AMF确定终端的第一会话的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径。
702、AMF向SMF发送第二指示信息，第二指示信息用于指示终端的第一会话的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径。相应的，SMF从AMF接收第二指示信息。
703、SMF进行UPF选择。
在步骤703之前，SMF可以确定重选UPF，重选之前的UPF记为UPF1，重选之后的UPF记为UPF2。示例性的，若终端已经不在RAN节点连接的UPF1的服务范围内，SMF会选择一个新的UPF(即UPF2)或者PDU会话锚点(PDU Session Anchor，简称PSA)为终端服务。
其中，SMF可以根据UPF选择规则(UPF selection criteria)来选择UPF。UPF选择规则至少包括：所选择UPF支持UE-UPF安全传输路径。
704、SMF根据第二指示信息确定终端的第一会话的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径。
步骤703和步骤704的执行顺序不分先后。
在步骤704之后，SMF可以通知UPF1释放第一会话。示例性的，SMF向UPF1发送N4会话修改请求，UPF1根据N4会话修改请求释放第一会话之后，向SMF发送N4会话修改响应(N4 Session Modification Response)。N4会话修改响应用于指示UPF1释放第一会话完毕。
705、SMF向UPF2发送第一消息B，第一消息B用于指示将终端的第一会话的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径。相应的，UPF2从SMF接收第一消息B。
其中，第一消息B中可以包括第一会话的标识，还可以包括第一指示信息。
706、UPF2根据第一消息B获取第一会话的安全上下文，并采用第一会话的安全上下文对第一会话进行安全保护。
707、AMF向RAN节点发送第一消息A，第一消息A用于指示将终端的第一会话的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径。相应的，RAN节点从AMF接收第一消息A。
其中，第一消息A中可以包括第一会话的标识和第一指示信息。
708、RAN节点根据第一消息A删除第一会话的安全上下文。
709、RAN节点根据第一消息A向终端发送第二消息，第二消息用于指示将终端的第一会话的安全传输路径从UE-RAN安全传输路径切换至UE-UPF安全传输路径。相应的，终端从RAN节点接收第二消息。
其中，第二消息中可以包括第一会话的标识和第一指示信息。
710、终端根据第二消息将第一会话的安全上下文从源安全上下文切换至目标安全上下文。
711、终端根据第一会话的目标安全上下文传输属于第一会话的数据。
在图7所示的实施例中，若UPF之间有接口，也可以由UPF1确定重选UPF。此时，UPF1进行UPF选择，并向SMF和选择出的UPF2发送重选指示，该重选指示用于指示UPF被重选至UPF2。该情况下，步骤703可以不执行，UPF1可以自行释放会话，而不依赖于SMF发送的N4会话修改请求。
需要说明的是，本申请上述实施例中的第一消息和第二消息中的任意一个消息中包含的不同的信息也可以携带在不同的消息中，本申请实施例对此不作具体限定。
上述主要从各个网元之间交互的角度对本申请实施例的方案进行了介绍。可以理解的是，各个网元，例如，移动性管理网元、会话管理网元、终端、接入网节点或用户面网元等为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对移动性管理网元、会话管理网元、终端、接入网节点或用户面网元等进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用集成的单元的情况下，图8示出了上述实施例中所涉及的切换传输路径的装置(记为切换传输路径的装置80)的一种可能的结构示意图，该切换传输路径的装置80包括处理单元801和通信单元802，还可以包括存储单元803。图8所示的结构示意图可以用于示意上述实施例中所涉及的移动性管理网元、会话管理网元、终端、接入网节点或用户面网元的结构。
当图8所示的结构示意图用于示意上述实施例中所涉及的移动性管理网元(例如，AMF)的结构时，处理单元801用于对移动性管理网元的动作进行控制管理。例如，处理单元801用于支持移动性管理网元执行图3和图4中的步骤300a、步骤301a和步骤302a，图5和图6中的步骤301a、步骤300b和步骤302a，图7中的步骤701、步骤702和步骤707，和/或本申请实施例中所描述的其他过程中的移动性管理网元执行的动作。处理单元801可以通过通信单元802与其他网络实体通信，例如，与图3中示出的会话管理网元(即SMF)之间的通信。存储单元803用于存储移动性管理网元的程序代码和数据。
当图8所示的结构示意图用于示意上述实施例中所涉及的移动性管理网元的结构时，切换传输路径的装置80可以是移动性管理网元，也可以是移动性管理网元内的芯片。
当图8所示的结构示意图用于示意上述实施例中所涉及的会话管理网元(例如，SMF)的结构时，处理单元801用于对会话管理网元的动作进行控制管理。例如，处理单元801用于支持会话管理网元执行图3和图4中的步骤301b、步骤300a和步骤302b，图5和图6中的步骤300b、步骤301b和步骤302b，图7中的步骤702至步骤705，和/或本申请实施例中所描述的其他过程中的会话管理网元执行的动作。处理单元801可以通过通信单元802与其他网络实体通信，例如，与图3中示出的移动性管理网元(即AMF)之间的通信。存储单元803用于存储会话管理网元的程序代码和数据。
当图8所示的结构示意图用于示意上述实施例中所涉及的会话管理网元的结构时，切换传输路径的装置80可以是会话管理网元，也可以是会话管理网元内的芯片。
当图8所示的结构示意图用于示意上述实施例中所涉及的用户面网关(例如，图3至图6中的UPF，图7中的UPF2)的结构时，处理单元801用于对用户面网关的动作进行控制管理。例如，处理单元801用于支持用户面网关执行图3和图5中的步骤302b和步骤304b，图4和图6中的步骤302b和步骤303b，图7中的步骤705和步骤706，和/或本申请实施例中所描述的其他过程中的用户面网关执行的动作。处理单元801可以通过通信单元802与其他网络实体通信，例如，与图7中示出的会话管理网元(即SMF)之间的通信。存储单元803用于存储用户面网关的程序代码和数据。
当图8所示的结构示意图用于示意上述实施例中所涉及的用户面网关的结构时， 切换传输路径的装置80可以是用户面网关，也可以是用户面网关内的芯片。
当图8所示的结构示意图用于示意上述实施例中所涉及的接入网节点(例如，RAN节点)的结构时，处理单元801用于对接入网节点的动作进行控制管理。例如，处理单元801用于支持接入网节点执行图3和图5中的步骤302a、步骤303a和步骤305，图4和图6中的步骤302a、步骤304a和步骤305，图7中的步骤707至步骤709，和/或本申请实施例中所描述的其他过程中的接入网节点执行的动作。处理单元801可以通过通信单元802与其他网络实体通信，例如，与图7中示出的终端之间的通信。存储单元803用于存储接入网节点的程序代码和数据。
当图8所示的结构示意图用于示意上述实施例中所涉及的接入网节点的结构时，切换传输路径的装置80可以是接入网节点，也可以是接入网节点内的芯片。
当图8所示的结构示意图用于示意上述实施例中所涉及的终端的结构时，处理单元801用于对终端的动作进行控制管理。例如，处理单元801用于支持终端执行图3至图6中的步骤305、步骤306和步骤307，图7中的步骤709至步骤711，和/或本申请实施例中所描述的其他过程中的终端执行的动作。处理单元801可以通过通信单元802与其他网络实体通信，例如，与图7中示出的接入网节点(即RAN节点)之间的通信。存储单元803用于存储终端的程序代码和数据。
当图8所示的结构示意图用于示意上述实施例中所涉及的终端的结构时，切换传输路径的装置80可以是终端，也可以是终端内的芯片。
其中，通信单元也可以称为收发单元。切换传输路径的装置80中的具有收发功能的天线和控制电路可以视为切换传输路径的装置80的通信单元802，具有处理功能的处理器可以视为切换传输路径的装置80的处理单元801。可选的，通信单元802中用于实现接收功能的器件可以视为接收单元，接收单元用于执行本申请实施例中的接收的步骤，接收单元可以为接收机、接收器、接收电路等。通信单元802中用于实现发送功能的器件可以视为发送单元，发送单元用于执行本申请实施例中的发送的步骤，发送单元可以为发送机、发送器、发送电路等。
图8中的集成的单元如果以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。存储计算机软件产品的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，简称ROM)、随机存取存储器(random access memory，简称RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
本申请实施例中的单元也可以称为模块，例如，处理单元可以称为处理模块。
图9所示为本申请实施例提供的切换传输路径的装置的硬件结构示意图，该切换传输路径的装置可以为本文中的移动性管理网元、会话管理网元、终端、接入网节点或用户面网元。该切换传输路径的装置90包括至少一个处理器901，通信总线902以及至少一个通信接口904。可选的，还包括存储器903。图9中以切换传输路径的装置 90包括一个处理器901和一个通信接口904为例进行绘制。
处理器901、通信接口904和存储器903之间可以通过通信总线902连接实现互相通信，传递控制和/或数据信号，该存储器903用于存储计算机程序，该处理器901用于从该存储器903中调用并运行该计算机程序，以控制该通信接口904收发信号。
在第一种可能的实现方式中，处理器901可以是一个通用中央处理器(central processing unit，简称CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，简称ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。通信接口904，可以为任何收发器一类的装置。
在第二种可能的实现方式中，处理器901可以为逻辑电路，通信接口904可以包括输入接口和输出接口。
存储器903可以是ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，简称EEPROM)、只读光盘(compact disc read-only memory，简称CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信总线902与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器903用于存储执行本申请方案的计算机执行指令，并由处理器901来控制执行。处理器901用于执行存储器903中存储的计算机执行指令，从而实现本申请上述实施例提供的方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
当图9所示的结构示意图用于示意上述实施例中所涉及的移动性管理网元(例如，AMF)的结构时，处理器901用于对移动性管理网元的动作进行控制管理。例如，处理器901用于支持移动性管理网元执行图3和图4中的步骤300a、步骤301a和步骤302a，图5和图6中的步骤301a、步骤300b和步骤302a，图7中的步骤701、步骤702和步骤707，和/或本申请实施例中所描述的其他过程中的移动性管理网元执行的动作。处理器901可以通过通信接口904与其他网络实体通信，例如，与图3中示出的会话管理网元(即SMF)之间的通信。存储器903用于存储移动性管理网元的程序代码和数据。
当图9所示的结构示意图用于示意上述实施例中所涉及的会话管理网元(例如，SMF)的结构时，处理器901用于对会话管理网元的动作进行控制管理。例如，处理器901用于支持会话管理网元执行图3和图4中的步骤301b、步骤300a和步骤302b，图5和图6中的步骤300b、步骤301b和步骤302b，图7中的步骤702至步骤705，和/或本申请实施例中所描述的其他过程中的会话管理网元执行的动作。处理器901可以通过通信接口904与其他网络实体通信，例如，与图3中示出的移动性管理网元(即AMF)之间的通信。存储器903用于存储会话管理网元的程序代码和数据。
当图9所示的结构示意图用于示意上述实施例中所涉及的用户面网关(例如，图 3至图6中的UPF，图7中的UPF2)的结构时，处理器901用于对用户面网关的动作进行控制管理，例如，处理器901用于支持用户面网关执行图3和图5中的步骤302b和步骤304b，图4和图6中的步骤302b和步骤303b，图7中的步骤705和步骤706，和/或本申请实施例中所描述的其他过程中的用户面网关执行的动作。处理器901可以通过通信接口904与其他网络实体通信，例如，与图7中示出的会话管理网元(即SMF)之间的通信。存储器903用于存储用户面网关的程序代码和数据。
当图9所示的结构示意图用于示意上述实施例中所涉及的接入网节点(例如，RAN节点)的结构时，处理器901用于对接入网节点的动作进行控制管理，例如，处理器901用于支持接入网节点执行图3和图5中的步骤302a、步骤303a和步骤305，图4和图6中的步骤302a、步骤304a和步骤305，图7中的步骤707至步骤709，和/或本申请实施例中所描述的其他过程中的接入网节点执行的动作。处理器901可以通过通信接口904与其他网络实体通信，例如，与图7中示出的终端之间的通信。存储器903用于存储接入网节点的程序代码和数据。
当图9所示的结构示意图用于示意上述实施例中所涉及的终端的结构时，处理器901用于对终端的动作进行控制管理，例如，处理器901用于支持终端执行图3至图6中的步骤305、步骤306和步骤307，图7中的步骤709至步骤711，和/或本申请实施例中所描述的其他过程中的终端执行的动作。处理器901可以通过通信接口904与其他网络实体通信，例如，与图7中示出的接入网节点(即RAN节点)之间的通信。存储器903用于存储终端的程序代码和数据。
本申请实施例还提供了一种终端(记为终端100)和接入网节点(记为接入网节点110)的硬件结构示意图。具体可参见图10。
终端100包括至少一个处理器1001和至少一个收发器1003。可选的，还包括至少一个存储器1002。可选的，终端100还包括至少一个天线1004。可选的，终端100还包括输出设备1005和/或输入设备1006。
处理器1001用于对终端的动作进行控制管理，例如，处理器1001用于支持终端执行图3至图6中的步骤305、步骤306和步骤307，图7中的步骤709至步骤711，和/或本申请实施例中所描述的其他过程中的终端执行的动作。处理器1001可以通过收发器1003与其他网络实体通信，例如，与图7中示出的RAN节点之间的通信。存储器1002用于存储终端的程序代码和数据。
关于处理器1001和存储器1002的其他描述可分别参见处理器901和存储器903的描述，在此不再赘述。收发器1003与通信接口904的功能类似，收发器1003的描述可参见通信接口904的描述，在此不再赘述。
输出设备1005和处理器1001通信，可以以多种方式来显示信息。例如，输出设备1005可以是液晶显示器(liquid crystal display，简称LCD)，发光二级管(light emitting diode，简称LED)显示设备，阴极射线管(cathode ray tube，简称CRT)显示设备，或投影仪(projector)等。输入设备1006和处理器1001通信，可以以多种方式接收用户的输入。例如，输入设备1006可以是鼠标、键盘、触摸屏设备或传感设备等。
可选的，收发器1003可以包括发射机10031和接收机10032。收发器1003中用 于实现接收功能的器件可以视为接收机10032，接收机10032用于执行本申请实施例中的接收的步骤。收发器1003中用于实现发送功能的器件可以视为发射机10031，发射机10031用于执行本申请实施例中的发送的步骤。
接入网节点110包括至少一个处理器1101和至少一个收发器1103。可选的，还包括至少一个存储器1102。可选的，接入网节点110还包括至少一个天线1104。
处理器1101用于对接入网节点的动作进行控制管理，例如，处理器1101用于支持接入网节点执行图3和图5中的步骤302a、步骤303a和步骤305，图4和图6中的步骤302a、步骤304a和步骤305，图7中的步骤707至步骤709，和/或本申请实施例中所描述的其他过程中的接入网节点执行的动作。处理器1101可以通过收发器1103与其他网络实体通信，例如，与图7中示出的终端之间的通信。存储器1102用于存储接入网节点的程序代码和数据。
处理器1101、存储器1102和收发器1103通过通信总线1102相连接。关于处理器1101和存储器1102的其他描述可分别参见处理器901和存储器903的描述，在此不再赘述。收发器1103与通信接口904的功能类似，收发器1103的描述可参见通信接口904的描述，在此不再赘述。
可选的，收发器1103可以包括发射机11031和接收机11032。收发器1103中用于实现接收功能的器件可以视为接收机11032，接收机11032用于执行本申请实施例中的接收的步骤。收发器1103中用于实现发送功能的器件可以视为发射机11031，发射机11031用于执行本申请实施例中的发送的步骤。
可选的，处理器(例如，处理器901、处理器1101或处理器1001)可以包括基带处理器和中央处理器，基带处理器主要用于对通信协议以及通信数据进行处理，中央处理器主要用于对整个设备进行控制，执行软件程序，处理软件程序的数据。处理器集成了基带处理器和中央处理器的功能，本领域技术人员可以理解，基带处理器和中央处理器也可以是各自独立的处理器，通过总线等技术互联。基带处理器也可以表述为基带处理电路或者基带处理芯片。该中央处理器也可以表述为中央处理电路或者中央处理芯片。对通信协议以及通信数据进行处理的功能可以内置在处理器中，也可以以软件程序的形式存储在存储单元中，由处理器执行软件程序以实现基带处理功能。
本申请实施例还提供了一种计算机可读存储介质，包括指令，当其在计算机上运行时，使得计算机执行上述任一方法。
本申请实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述任一方法。
本申请实施例还提供了一种装置，该装置以芯片的产品形态存在，该装置包括处理器、存储器和收发组件，收发组件包括输入输出电路，存储器用于存储计算机执行指令，处理器通过执行存储器中存储的计算机执行指令实现上述任一方法。该情况下，执行本申请实施例提供的方法的执行主体可以为芯片。
本申请实施例还提供了一种通信系统，包括：上述移动性管理网元、会话管理网元、终端、接入网节点和用户面网元。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式来实现。该 计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，计算机指令可以从一个网站站点、计算机、服务器或者数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，简称DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可以用介质集成的服务器、数据中心等数据存储设备。可用介质可以是磁性介质(例如，软盘、硬盘、磁带)，光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，简称SSD))等。
尽管在此结合各实施例对本申请进行了描述，然而，在实施所要求保护的本申请过程中，本领域技术人员通过查看附图、公开内容、以及所附权利要求书，可理解并实现公开实施例的其他变化。在权利要求中，“包括”(comprising)一词不排除其他组成部分或步骤，“一”或“一个”不排除多个的情况。单个处理器或其他单元可以实现权利要求中列举的若干项功能。相互不同的从属权利要求中记载了某些措施，但这并不表示这些措施不能组合起来产生良好的效果。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (34)

  1. 一种切换传输路径的方法，其特征在于，包括：
    终端从接入网节点接收第二消息，所述第二消息用于指示切换所述终端的安全传输路径，所述终端的安全传输路径包括第一安全传输路径和第二安全传输路径，所述第一安全传输路径是安全终结点为接入网节点和所述终端的用户面传输路径，所述第二安全传输路径是安全终结点为用户面网关和所述终端的用户面传输路径，所述安全终结点为对所述终端的用户面数据进行安全保护的节点；
    所述终端根据所述第二消息将所述终端的至少一个会话的安全上下文从源安全上下文切换至目标安全上下文，一个会话的源安全上下文为属于该会话的数据在源安全传输路径上传输时所述终端所使用的安全上下文，一个会话的目标安全上下文为属于该会话的数据在目标安全传输路径上传输时所述终端所使用的安全上下文；所述源安全传输路径为切换所述终端的安全传输路径之前所述终端的安全传输路径；所述目标安全传输路径为切换所述终端的安全传输路径之后所述终端的安全传输路径；
    所述终端根据所述至少一个会话的目标安全上下文在所述目标安全传输路径上传输属于所述至少一个会话的数据。
  2. 根据权利要求1所述的方法，其特征在于，所述第二消息中包括第一指示信息；所述第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，所述第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，所述源安全终结点为所述源安全传输路径的安全终结点；所述目标安全终结点为所述目标安全传输路径的安全终结点，所述源安全终结点和所述目标安全终结点中一个为所述接入网节点，另一个为所述用户面网关，所述方法还包括：
    在所述第一指示信息用于指示所述源安全传输路径的情况下，所述终端根据所述第二消息中的第一指示信息确定所述源安全传输路径；或者，
    在所述第一指示信息用于指示所述目标安全传输路径的情况下，所述终端根据所述第二消息中的第一指示信息确定所述目标安全传输路径；或者，
    在所述第一指示信息用于指示所述源安全传输路径和所述目标安全传输路径的情况下，所述终端根据所述第二消息中的第一指示信息确定所述源安全传输路径和所述目标安全传输路径；或者，
    在所述第一指示信息用于指示所述源安全终结点的情况下，所述终端根据所述第二消息中的第一指示信息确定所述源安全终结点；或者，
    在所述第一指示信息用于指示所述目标安全终结点的情况下，所述终端根据所述第二消息中的第一指示信息确定所述目标安全终结点；或者，
    在所述第一指示信息用于指示所述源安全终结点和所述目标安全终结点的情况下，所述终端根据所述第二消息中的第一指示信息确定所述源安全终结点和所述目标安全终结点。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第二消息还包括第一会话的标识，所述第二消息具体用于指示切换所述终端的所述第一会话的安全传输路径，所述至少一个会话为所述第一会话。
  4. 根据权利要求3所述的方法，其特征在于，所述第二消息还包括所述第一会话 的第一业务流的标识，所述第二消息具体用于指示切换所述终端的所述第一会话的所述第一业务流的安全传输路径；
    所述终端根据所述第二消息将所述终端的至少一个会话的安全上下文从源安全上下文切换至目标安全上下文，包括：所述终端根据所述第二消息将所述第一会话的所述第一业务流的安全上下文从源安全上下文切换至目标安全上下文；一个业务流的源安全上下文为属于该业务流的数据在源安全传输路径上传输时所述终端所使用的安全上下文，一个业务流的目标安全上下文为属于该业务流的数据在目标安全传输路径上传输时所述终端所使用的安全上下文；
    所述终端根据所述至少一个会话的目标安全上下文在所述目标安全传输路径上传输属于所述至少一个会话的数据，包括：所述终端根据所述第一会话的所述第一业务流的目标安全上下文在所述目标安全传输路径上传输属于所述第一会话的所述第一业务流的数据。
  5. 一种切换传输路径的方法，其特征在于，包括：
    第一网元确定切换终端的安全传输路径，所述终端的安全传输路径包括第一安全传输路径和第二安全传输路径，所述第一安全传输路径是安全终结点为接入网节点和所述终端的用户面传输路径，所述第二安全传输路径是安全终结点为用户面网关和所述终端的用户面传输路径，所述安全终结点为对所述终端的用户面数据进行安全保护的节点；
    所述第一网元向第二网元发送第一消息，所述第一消息用于指示切换所述终端的安全传输路径；
    其中，所述第一网元为移动性管理网元，所述第二网元为所述接入网节点；或者，所述第一网元为会话管理网元，所述第二网元为所述用户面网关。
  6. 根据权利要求5所述的方法，其特征在于，所述第一消息包括第一指示信息；所述第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，所述第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，所述源安全传输路径为切换所述终端的安全传输路径之前所述终端的安全传输路径；所述目标安全传输路径为切换所述终端的安全传输路径之后所述终端的安全传输路径；所述源安全终结点为所述源安全传输路径的安全终结点；所述目标安全终结点为所述目标安全传输路径的安全终结点，所述源安全终结点和所述目标安全终结点中一个为所述接入网节点，另一个为所述用户面网关。
  7. 根据权利要求5或6所述的方法，其特征在于，所述第一消息还包括第一会话的标识，所述第一消息具体用于指示切换所述终端的所述第一会话的安全传输路径。
  8. 根据权利要求7所述的方法，其特征在于，所述第一消息还包括所述第一会话的第一业务流的标识，所述第一消息具体用于指示切换所述第一业务流的安全传输路径。
  9. 一种切换传输路径的方法，其特征在于，包括：
    第二网元从第一网元接收第一消息，所述第一消息用于指示切换终端的安全传输路径，所述终端的安全传输路径包括第一安全传输路径和第二安全传输路径，所述第一安全传输路径是安全终结点为接入网节点和所述终端的用户面传输路径，所述第二 安全传输路径是安全终结点为用户面网关和所述终端的用户面传输路径，所述安全终结点为对所述终端的用户面数据进行安全保护的节点；其中，所述第一网元为移动性管理网元，所述第二网元为所述接入网节点；或者，所述第一网元为会话管理网元，所述第二网元为所述用户面网关；
    在目标安全传输路径的安全终结点包括所述第二网元的情况下，所述第二网元根据所述第一消息获取所述终端的至少一个会话的安全上下文，并采用所述至少一个会话的安全上下文对所述至少一个会话进行安全保护；其中，所述至少一个会话为从源安全传输路径切换到所述目标安全传输路径的会话，所述源安全传输路径为切换所述终端的安全传输路径之前所述终端的安全传输路径；所述目标安全传输路径为切换所述终端的安全传输路径之后所述终端的安全传输路径。
  10. 根据权利要求9所述的方法，其特征在于，所述第一消息包括第一指示信息；所述第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，所述第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，所述源安全终结点为所述源安全传输路径的安全终结点；所述目标安全终结点为所述目标安全传输路径的安全终结点，所述源安全终结点和所述目标安全终结点中一个为所述接入网节点，另一个为所述用户面网关，所述方法还包括：
    在所述第一指示信息用于指示所述源安全传输路径的情况下，所述第二网元根据所述第一消息中的第一指示信息确定所述源安全传输路径；或者，
    在所述第一指示信息用于指示所述目标安全传输路径的情况下，所述第二网元根据所述第一消息中的第一指示信息确定所述目标安全传输路径；或者，
    在所述第一指示信息用于指示所述源安全传输路径和所述目标安全传输路径的情况下，所述第二网元根据所述第一消息中的第一指示信息确定所述源安全传输路径和所述目标安全传输路径；或者，
    在所述第一指示信息用于指示所述源安全终结点的情况下，所述第二网元根据所述第一消息中的第一指示信息确定所述源安全终结点；或者，
    在所述第一指示信息用于指示所述目标安全终结点的情况下，所述第二网元根据所述第一消息中的第一指示信息确定所述目标安全终结点；或者，
    在所述第一指示信息用于指示所述源安全终结点和所述目标安全终结点的情况下，所述第二网元根据所述第一消息中的第一指示信息确定所述源安全终结点和所述目标安全终结点。
  11. 根据权利要求9或10所述的方法，其特征在于，所述第一消息还包括第一会话的标识，所述第一消息具体用于指示切换所述终端的所述第一会话的安全传输路径，所述至少一个会话为所述第一会话。
  12. 根据权利要求11所述的方法，其特征在于，所述第一消息还包括所述第一会话的第一业务流的标识，所述第一消息具体用于指示切换所述终端的所述第一会话的所述第一业务流的安全传输路径；
    所述第二网元根据所述第一消息获取所述终端的至少一个会话的安全上下文，包括：所述第二网元根据所述第一消息获取所述第一会话的所述第一业务流的安全上下文。
  13. 根据权利要求9-12任一项所述的方法，其特征在于，所述第二网元为所述接入网节点，所述方法还包括：
    所述第二网元根据所述第一消息向所述终端发送第二消息，所述第二消息用于指示切换所述终端的安全传输路径。
  14. 根据权利要求13所述的方法，其特征在于，在所述第一消息包括所述第一指示信息的情况下，所述第二消息包括所述第一指示信息。
  15. 根据权利要求13或14所述的方法，其特征在于，在所述第一消息还包括所述第一会话的标识的情况下，所述第二消息还包括所述第一会话的标识，所述第二消息具体用于指示切换所述终端的所述第一会话的安全传输路径。
  16. 根据权利要求13-15任一项所述的方法，其特征在于，在所述第一消息还包括所述第一会话的第一业务流的标识的情况下，所述第二消息还包括所述第一会话的第一业务流的标识，所述第二消息具体用于指示切换所述第一业务流的安全传输路径。
  17. 一种切换传输路径的装置，其特征在于，包括：通信单元和处理单元；
    所述通信单元，用于从接入网节点接收第二消息，所述第二消息用于指示切换所述切换传输路径的装置的安全传输路径，所述切换传输路径的装置的安全传输路径包括第一安全传输路径和第二安全传输路径，所述第一安全传输路径是安全终结点为接入网节点和所述切换传输路径的装置的用户面传输路径，所述第二安全传输路径是安全终结点为用户面网关和所述切换传输路径的装置的用户面传输路径，所述安全终结点为对所述切换传输路径的装置的用户面数据进行安全保护的节点；
    所述处理单元，用于根据所述第二消息将所述切换传输路径的装置的至少一个会话的安全上下文从源安全上下文切换至目标安全上下文，一个会话的源安全上下文为属于该会话的数据在源安全传输路径上传输时所述切换传输路径的装置所使用的安全上下文，一个会话的目标安全上下文为属于该会话的数据在目标安全传输路径上传输时所述切换传输路径的装置所使用的安全上下文；所述源安全传输路径为切换所述切换传输路径的装置的安全传输路径之前所述切换传输路径的装置的安全传输路径；所述目标安全传输路径为切换所述切换传输路径的装置的安全传输路径之后所述切换传输路径的装置的安全传输路径；
    所述处理单元，还用于根据所述至少一个会话的目标安全上下文在所述目标安全传输路径上传输属于所述至少一个会话的数据。
  18. 根据权利要求17所述的装置，其特征在于，所述第二消息中包括第一指示信息；所述第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，所述第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，所述源安全终结点为所述源安全传输路径的安全终结点；所述目标安全终结点为所述目标安全传输路径的安全终结点，所述源安全终结点和所述目标安全终结点中一个为所述接入网节点，另一个为所述用户面网关；
    在所述第一指示信息用于指示所述源安全传输路径的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述源安全传输路径；或者，
    在所述第一指示信息用于指示所述目标安全传输路径的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述目标安全传输路径；或者，
    在所述第一指示信息用于指示所述源安全传输路径和所述目标安全传输路径的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述源安全传输路径和所述目标安全传输路径；或者，
    在所述第一指示信息用于指示所述源安全终结点的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述源安全终结点；或者，
    在所述第一指示信息用于指示所述目标安全终结点的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述目标安全终结点；或者，
    在所述第一指示信息用于指示所述源安全终结点和所述目标安全终结点的情况下，所述处理单元，还用于根据所述第二消息中的第一指示信息确定所述源安全终结点和所述目标安全终结点。
  19. 根据权利要求17或18所述的装置，其特征在于，所述第二消息还包括第一会话的标识，所述第二消息具体用于指示切换所述切换传输路径的装置的所述第一会话的安全传输路径，所述至少一个会话为所述第一会话。
  20. 根据权利要求19所述的装置，其特征在于，所述第二消息还包括所述第一会话的第一业务流的标识，所述第二消息具体用于指示切换所述切换传输路径的装置的所述第一会话的所述第一业务流的安全传输路径；
    所述处理单元，具体用于：根据所述第二消息将所述第一会话的所述第一业务流的安全上下文从源安全上下文切换至目标安全上下文；一个业务流的源安全上下文为属于该业务流的数据在源安全传输路径上传输时所述切换传输路径的装置所使用的安全上下文，一个业务流的目标安全上下文为属于该业务流的数据在目标安全传输路径上传输时所述切换传输路径的装置所使用的安全上下文；
    所述处理单元，具体用于：根据所述第一会话的所述第一业务流的目标安全上下文在所述目标安全传输路径上传输属于所述第一会话的所述第一业务流的数据。
  21. 一种切换传输路径的装置，其特征在于，包括：通信单元和处理单元；
    所述处理单元，用于确定切换终端的安全传输路径，所述终端的安全传输路径包括第一安全传输路径和第二安全传输路径，所述第一安全传输路径是安全终结点为接入网节点和所述终端的用户面传输路径，所述第二安全传输路径是安全终结点为用户面网关和所述终端的用户面传输路径，所述安全终结点为对所述终端的用户面数据进行安全保护的节点；
    所述通信单元，用于向第二网元发送第一消息，所述第一消息用于指示切换所述终端的安全传输路径；
    其中，所述切换传输路径的装置为移动性管理网元，所述第二网元为所述接入网节点；或者，所述切换传输路径的装置为会话管理网元，所述第二网元为所述用户面网关。
  22. 根据权利要求21所述的装置，其特征在于，所述第一消息包括第一指示信息；所述第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，所述第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，所述源安全传输路径为切换所述终端的安全传输路径之前所述终端的安全传输路径；所述目标安全传输路径为切换所述终端的安全传输路径之后所述终端的安全传输路径；所述源安全终结点为 所述源安全传输路径的安全终结点；所述目标安全终结点为所述目标安全传输路径的安全终结点，所述源安全终结点和所述目标安全终结点中一个为所述接入网节点，另一个为所述用户面网关。
  23. 根据权利要求21或22所述的装置，其特征在于，所述第一消息还包括第一会话的标识，所述第一消息具体用于指示切换所述终端的所述第一会话的安全传输路径。
  24. 根据权利要求23所述的装置，其特征在于，所述第一消息还包括所述第一会话的第一业务流的标识，所述第一消息具体用于指示切换所述第一业务流的安全传输路径。
  25. 一种切换传输路径的装置，其特征在于，包括：通信单元和处理单元；
    所述通信单元，用于从第一网元接收第一消息，所述第一消息用于指示切换终端的安全传输路径，所述终端的安全传输路径包括第一安全传输路径和第二安全传输路径，所述第一安全传输路径是安全终结点为接入网节点和所述终端的用户面传输路径，所述第二安全传输路径是安全终结点为用户面网关和所述终端的用户面传输路径，所述安全终结点为对所述终端的用户面数据进行安全保护的节点；其中，所述第一网元为移动性管理网元，所述切换传输路径的装置为所述接入网节点；或者，所述第一网元为会话管理网元，所述切换传输路径的装置为所述用户面网关；
    在目标安全传输路径的安全终结点包括所述切换传输路径的装置的情况下，所述处理单元，用于根据所述第一消息获取所述终端的至少一个会话的安全上下文，并采用所述至少一个会话的安全上下文对所述至少一个会话进行安全保护；其中，所述至少一个会话为从源安全传输路径切换到所述目标安全传输路径的会话，所述源安全传输路径为切换所述终端的安全传输路径之前所述终端的安全传输路径；所述目标安全传输路径为切换所述终端的安全传输路径之后所述终端的安全传输路径。
  26. 根据权利要求25所述的装置，其特征在于，所述第一消息包括第一指示信息；所述第一指示信息用于指示源安全传输路径和/或目标安全传输路径，或者，所述第一指示信息用于指示源安全终结点和/或目标安全终结点；其中，所述源安全终结点为所述源安全传输路径的安全终结点；所述目标安全终结点为所述目标安全传输路径的安全终结点，所述源安全终结点和所述目标安全终结点中一个为所述接入网节点，另一个为所述用户面网关；
    在所述第一指示信息用于指示所述源安全传输路径的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述源安全传输路径；或者，
    在所述第一指示信息用于指示所述目标安全传输路径的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述目标安全传输路径；或者，
    在所述第一指示信息用于指示所述源安全传输路径和所述目标安全传输路径的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述源安全传输路径和所述目标安全传输路径；或者，
    在所述第一指示信息用于指示所述源安全终结点的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述源安全终结点；或者，
    在所述第一指示信息用于指示所述目标安全终结点的情况下，所述处理单元，还 用于根据所述第一消息中的第一指示信息确定所述目标安全终结点；或者，
    在所述第一指示信息用于指示所述源安全终结点和所述目标安全终结点的情况下，所述处理单元，还用于根据所述第一消息中的第一指示信息确定所述源安全终结点和所述目标安全终结点。
  27. 根据权利要求25或26所述的装置，其特征在于，所述第一消息还包括第一会话的标识，所述第一消息具体用于指示切换所述终端的所述第一会话的安全传输路径，所述至少一个会话为所述第一会话。
  28. 根据权利要求27所述的装置，其特征在于，所述第一消息还包括所述第一会话的第一业务流的标识，所述第一消息具体用于指示切换所述终端的所述第一会话的所述第一业务流的安全传输路径；
    所述处理单元，具体用于：根据所述第一消息获取所述第一会话的所述第一业务流的安全上下文。
  29. 根据权利要求25-28任一项所述的装置，其特征在于，所述切换传输路径的装置为所述接入网节点；
    所述处理单元，还用于根据所述第一消息通过所述通信单元向所述终端发送第二消息，所述第二消息用于指示切换所述终端的安全传输路径。
  30. 根据权利要求29所述的装置，其特征在于，在所述第一消息包括所述第一指示信息的情况下，所述第二消息包括所述第一指示信息。
  31. 根据权利要求29或30所述的装置，其特征在于，在所述第一消息还包括所述第一会话的标识的情况下，所述第二消息还包括所述第一会话的标识，所述第二消息具体用于指示切换所述终端的所述第一会话的安全传输路径。
  32. 根据权利要求29-31任一项所述的装置，其特征在于，在所述第一消息还包括所述第一会话的第一业务流的标识的情况下，所述第二消息还包括所述第一会话的第一业务流的标识，所述第二消息具体用于指示切换所述第一业务流的安全传输路径。
  33. 一种切换传输路径的装置，其特征在于，存储器和处理器；
    所述存储器用于存储计算机执行指令，所述处理器执行所述存储器存储的所述计算机执行指令，以使所述切换传输路径的装置实现如权利要求1-4中的任一项所述的方法；或者，实现如权利要求5-8中的任一项所述的方法；或者，实现如权利要求9-16中的任一项所述的方法。
  34. 一种计算机可读存储介质，其特征在于，包括指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1-4中的任一项所述的方法；或者，实现如权利要求5-8中的任一项所述的方法；或者，实现如权利要求9-16中的任一项所述的方法。
PCT/CN2019/070714 2019-01-07 2019-01-07 切换传输路径的方法及装置 WO2020142884A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2019/070714 WO2020142884A1 (zh) 2019-01-07 2019-01-07 切换传输路径的方法及装置
CN201980065195.9A CN112789896B (zh) 2019-01-07 2019-01-07 切换传输路径的方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/070714 WO2020142884A1 (zh) 2019-01-07 2019-01-07 切换传输路径的方法及装置

Publications (1)

Publication Number Publication Date
WO2020142884A1 true WO2020142884A1 (zh) 2020-07-16

Family

ID=71520600

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/070714 WO2020142884A1 (zh) 2019-01-07 2019-01-07 切换传输路径的方法及装置

Country Status (2)

Country Link
CN (1) CN112789896B (zh)
WO (1) WO2020142884A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022017285A1 (zh) * 2020-07-23 2022-01-27 华为技术有限公司 报文转发方法、装置及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015199241A1 (en) * 2014-06-23 2015-12-30 Nec Corporation Communication system adapted for key derivation during handover
CN105792189A (zh) * 2014-12-26 2016-07-20 中兴通讯股份有限公司 一种切换流程中安全信息的处理方法、接入网关及基站
CN108882315A (zh) * 2017-05-08 2018-11-23 电信科学技术研究院 一种路径切换方法及网络设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101072092B (zh) * 2006-05-11 2010-12-08 华为技术有限公司 一种实现控制面和用户面密钥同步的方法
CN100571441C (zh) * 2006-08-21 2009-12-16 中兴通讯股份有限公司 演进的无线系统与传统的无线系统间的切换方法
CN101772100B (zh) * 2008-12-29 2012-03-28 中国移动通信集团公司 LTE系统中基站eNB切换时的密钥更新方法、设备及系统
US8681740B2 (en) * 2010-12-21 2014-03-25 Tektronix, Inc. LTE network call correlation during User Equipment mobility
KR102010323B1 (ko) * 2014-02-21 2019-08-13 콘비다 와이어리스, 엘엘씨 통합된 소형 셀 및 ｗｉｆｉ 네트워크들에서의 핸드오버
CN108966220B (zh) * 2017-07-28 2019-07-23 华为技术有限公司 一种密钥推演的方法及网络设备

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015199241A1 (en) * 2014-06-23 2015-12-30 Nec Corporation Communication system adapted for key derivation during handover
CN105792189A (zh) * 2014-12-26 2016-07-20 中兴通讯股份有限公司 一种切换流程中安全信息的处理方法、接入网关及基站
CN108882315A (zh) * 2017-05-08 2018-11-23 电信科学技术研究院 一种路径切换方法及网络设备

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HUAWEI , HISILICON: "Clarification on UPF tunnel change", 3GPP DRAFT; S2-188841, 24 August 2018 (2018-08-24), Sophia Antipolis, France, XP051537644 *
HUAWEI , HISILICON: "Discussion on the Higher Layer Multi-Connectivity", 3GPP DRAFT; R2-1817508, 16 December 2018 (2018-12-16), Spokane, USA, pages 1 - 6, XP051481408 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022017285A1 (zh) * 2020-07-23 2022-01-27 华为技术有限公司 报文转发方法、装置及系统

Also Published As

Publication number Publication date
CN112789896A (zh) 2021-05-11
CN112789896B (zh) 2022-06-14

Similar Documents

Publication Publication Date Title
US11778459B2 (en) Secure session method and apparatus
US11246172B2 (en) Method for selecting session and service continuity mode in wireless communication system and device therefor
US11477689B2 (en) Method and apparatus for establishing guaranteed bit rate (GBR) quality of service (QoS) flow in session
US11770865B2 (en) Relay communication method and relay communications apparatus and system
KR101944097B1 (ko) 무선 통신 시스템에서 cu-cp와 cu-up의 분리를 위한 보안을 지원하는 방법 및 장치
US11722888B2 (en) Security context obtaining method and apparatus
US11811670B2 (en) Packet delay parameter obtaining method, system, and apparatus
US11533610B2 (en) Key generation method and related apparatus
WO2018232570A1 (zh) 一种注册及会话建立的方法、终端和amf实体
US11832340B2 (en) Session management method and apparatus
WO2019196643A1 (zh) 通信的方法和通信装置
US11206580B2 (en) Communication method and communications apparatus
US20230164640A1 (en) Communication method and communication apparatus
WO2019047935A1 (zh) 一种会话建立方法及装置
US11824783B2 (en) Maximum data burst volume (MDBV) determining method, apparatus, and system
WO2020142884A1 (zh) 切换传输路径的方法及装置
WO2019238050A1 (zh) 一种通信方法及装置
US20230018378A1 (en) Parameter configuration method, apparatus and system, device and storage medium
TW202243530A (zh) Ma pdu會話之處理方法及其使用者設備
WO2021138784A1 (zh) 一种接入网络的方法、装置及系统
WO2021163853A1 (zh) 数据传输方式的更改方法、装置、设备及存储介质
WO2022166891A1 (zh) 支持网络选择的方法、装置、设备及可读存储介质
TW202333530A (zh) 無線通信方法和相應的用戶設備

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19909564

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19909564

Country of ref document: EP

Kind code of ref document: A1